feat(project): complete isolated installations across supported clients

.github/workflows/agentplugins-native-clients.yml

@@ -2,7 +2,7 @@ name: Native Client Runtime
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, 'feat/project-*', feat/source-transports-e2e]
     paths:
       - 'repotests/agentplugins_*native*'
       - 'repotests/agentplugins_*runtime*'
@@ -69,10 +69,15 @@ jobs:
           AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
         shell: bash
         run: |
+          project_args=()
+          if [[ '${{ matrix.client }}' == 'codex' || '${{ matrix.client }}' == 'claude' || '${{ matrix.client }}' == 'opencode' ]]; then
+            project_args+=(--project-components)
+          fi
           python scripts/run-native-client-matrix.py \
             --client '${{ matrix.client }}' \
             --target '${{ matrix.platform.target }}' \
-            --output '${{ runner.temp }}/native-client-proof'
+            --output '${{ runner.temp }}/native-client-proof' \
+            "${project_args[@]}"
       - name: Upload native evidence including failed stages
         if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0

.github/workflows/cline-native-research.yml

@@ -0,0 +1,46 @@
+name: Cline Pinned Read-Only Config Research
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/cline-native-research.yml'
+      - 'scripts/research-cline-native.py'
+      - 'scripts/test_cline_native_research.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/research-grok-native.py'
+      - 'scripts/run-native-client-matrix.py'
+      - 'scripts/native_client_draft.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cline-native-research-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  research:
+    name: Cline 3.0.73 read-only config observations
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Verify inert research safety contracts
+        run: python3 -m unittest discover -s scripts -p 'test_*native_research.py'
+      - name: Capture genuine pinned configuration observations
+        env:
+          AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python3 scripts/research-cline-native.py --output '${{ runner.temp }}/cline-native-research'
+      - name: Upload research including failed collection
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: cline-3.0.73-precode-config-linux-amd64
+          path: ${{ runner.temp }}/cline-native-research/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/cline-project-native.yml

@@ -0,0 +1,71 @@
+name: Cline Current Source Read-Only Project Gate
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/cline-project-native.yml'
+      - 'cli/**'
+      - 'install/integrationctl/agentplugins/**'
+      - 'scripts/research-cline-project.py'
+      - 'scripts/cline_project_envelope.py'
+      - 'scripts/test_cline_project_*.py'
+      - 'scripts/research-cline-native.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/research-grok-native.py'
+      - 'scripts/run-native-client-matrix.py'
+      - 'scripts/native_client_project_artifacts.py'
+      - 'scripts/test_native_client_project_artifacts.py'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: cline-project-native-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  research:
+    name: Cline 3.0.73 actual UAP enabled config metadata
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Verify inert acquisition, publication and fixture contracts
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_cline_project_*.py'
+          python3 -m unittest discover -s scripts -p 'test_cline_native_research.py'
+          python3 -m unittest discover -s scripts -p 'test_native_client_project_artifacts.py'
+          (cd cli && go test -p=1 ./cmd/agentplugins -run '^TestClineGate')
+      - name: Observe pinned version and read-only config from actual UAP files
+        env:
+          AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python3 scripts/research-cline-project.py --output '${{ runner.temp }}/cline-project-native'
+      - name: Admit only exact bounded upload ZIP
+        id: upload_admission
+        if: ${{ always() }}
+        env:
+          RESEARCH_OUTPUT: ${{ runner.temp }}/cline-project-native/upload/research.zip
+        run: |
+          /usr/bin/python3 -I - <<'PYTHON'
+          import os, stat
+          from pathlib import Path
+          path = Path(os.environ['RESEARCH_OUTPUT'])
+          info = path.lstat()
+          if path.resolve() != path or not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_uid != os.getuid() or info.st_size > 32 * 1024 * 1024:
+              raise SystemExit('refusing nonregular or unbounded upload ZIP')
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('valid=true\n')
+          PYTHON
+      - name: Upload admitted evidence including failed stages
+        if: ${{ always() && steps.upload_admission.outputs.valid == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: cline-3.0.73-current-source-enabled-project-config-linux-amd64
+          path: ${{ runner.temp }}/cline-project-native/upload/research.zip
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/core-fast.yml

@@ -5,7 +5,7 @@ name: Core fast
 # fast enough to keep a part from waiting 10-27 minutes.
 on:
   pull_request:
-    branches: [main, 'refactor/**']
+    branches: [main, 'refactor/**', 'feat/project-*', feat/source-transports-e2e]
     paths:
       - 'install/integrationctl/agentplugins/**'
       # The only ports.PathPolicy implementation lives here.
@@ -32,6 +32,32 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  project-contracts:
+    name: project-contracts (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, windows-2025]
+    env:
+      GOMAXPROCS: '3'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        # Embedded schema digests bind exact Git bytes on every platform.
+        env:
+          GIT_CONFIG_COUNT: '1'
+          GIT_CONFIG_KEY_0: core.autocrlf
+          GIT_CONFIG_VALUE_0: 'false'
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.10"
+          cache: false
+      - name: Verify scoped ownership, path guards and disposable project lifecycle
+        run: go test -p=2 -count=1 -timeout=8m ./install/integrationctl/agentplugins/domain ./install/integrationctl/agentplugins/adapters/statev2 ./install/integrationctl/agentplugins/adapters/nativeconfig ./install/integrationctl/agentplugins/clients/... ./install/integrationctl/agentplugins/providers ./install/integrationctl/agentplugins/planner ./install/integrationctl/agentplugins/installer ./install/integrationctl/agentplugins/environment ./install/integrationctl/agentplugins/usecase ./cli/internal/agentpluginscli ./cli/cmd/agentplugins -run 'Test(TargetContext|Project|PrepareRejectsCrossEnvironmentContext)'
+
   opencode-transition-windows:
     name: opencode-transition-windows
     runs-on: windows-2025

.github/workflows/coverage.yml

@@ -38,11 +38,10 @@ jobs:
           mkdir -p coverage
           mapfile -t root_packages < <(go list ./... | grep -v '/repotests$')
           go test -count=1 -timeout=20m -covermode=atomic -coverprofile=coverage/root.out "${root_packages[@]}"
-          # These tests recursively execute the instrumented test binary with an
-          # intentionally minimal environment and assert byte-exact stderr. They
-          # remain covered by Required; Go's GOCOVERDIR warning makes them
-          # incompatible with coverage instrumentation itself.
-          go test -count=1 -timeout=20m -skip '^TestReleaseCompletionProcessStderr$' -covermode=atomic -coverprofile=coverage/cli.out ./cli/...
+          go test -count=1 -timeout=20m -covermode=atomic -coverprofile=coverage/cli.out ./cli/...
+          # The version-probe test re-executes its instrumented test binary with
+          # an intentionally minimal environment. Go's missing-GOCOVERDIR warning
+          # changes the probe output; Required still runs it without coverage.
           go test -count=1 -timeout=20m -skip '^TestExecutableVersionProbeIsSanitizedAndIsolated$' -covermode=atomic -coverprofile=coverage/integrationctl.out ./install/integrationctl/...
           # Nested module: do not use a parent-relative ./agentplugins/... glob.
           # That pattern needs go.work; GOWORK=off fails loud instead of covering

.github/workflows/grok-native-research.yml

@@ -0,0 +1,47 @@
+name: Grok Pinned Project Source Research
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/grok-native-research.yml'
+      - 'scripts/research-grok-native.py'
+      - 'scripts/test_grok_native_research.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/run-native-client-matrix.py'
+      - 'scripts/native_client_draft.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: grok-native-research-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  research:
+    name: Grok 1.0.67 project source observations
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Verify inert Grok and shared Qoder research safety contracts
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_grok_native_research.py'
+          python3 -m unittest discover -s scripts -p 'test_qoder_native_research.py'
+      - name: Capture pinned genuine source observations in fresh profiles
+        env:
+          AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python3 scripts/research-grok-native.py --output '${{ runner.temp }}/grok-native-research'
+      - name: Upload research including failed collection
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: grok-1.0.67-precode-project-source-linux-amd64
+          path: ${{ runner.temp }}/grok-native-research/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/project-git-diagnostic.yml

@@ -0,0 +1,26 @@
+name: Project Git Fixture Diagnostic
+
+on:
+  push:
+    branches: [fix/project-git-diagnostic-20261025]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  git-fixtures:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Observe bounded local Git cleanup once
+        env:
+          AGENTPLUGINS_GIT_CLEANUP_DIAGNOSTIC: '1'
+        run: go test -count=1 -timeout=7m -v -run '^TestOSRunnerLocalGitFetchCleanupObservation$' ./install/integrationctl/adapters/process

.github/workflows/project-windows-atomic-diagnostic.yml

@@ -0,0 +1,53 @@
+name: Windows atomic publication diagnostic
+
+on:
+  push:
+    branches: [fix/project-windows-atomic-20261025]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  qualify:
+    runs-on: windows-2025
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Record exact source and toolchain
+        shell: bash
+        run: |
+          mkdir -p "$RUNNER_TEMP/windows-atomic-evidence"
+          git rev-parse HEAD > "$RUNNER_TEMP/windows-atomic-evidence/commit.txt"
+          git rev-parse 'HEAD^{tree}' > "$RUNNER_TEMP/windows-atomic-evidence/tree.txt"
+          go version > "$RUNNER_TEMP/windows-atomic-evidence/go-version.txt"
+      - name: Qualify exact publication and refusal contracts once
+        shell: bash
+        run: |
+          go test -count=1 -timeout=2m -v ./install/integrationctl/adapters/atomicfile ./install/integrationctl/agentplugins/adapters/securityscan -run '^(TestWindowsAtomicPublicationHeldReaders|TestWindowsAtomicPublicationRefusals|TestWindowsAtomicPublicationUnicodeLongPath|TestWindowsAtomicPublicationSecurityCache)$' 2>&1 | tee "$RUNNER_TEMP/windows-atomic-evidence/tests.log"
+          python - "$RUNNER_TEMP/windows-atomic-evidence/tests.log" <<'PY'
+          import pathlib, re, sys
+          body = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")
+          expected = {
+              "TestWindowsAtomicPublicationHeldReaders",
+              "TestWindowsAtomicPublicationRefusals",
+              "TestWindowsAtomicPublicationUnicodeLongPath",
+              "TestWindowsAtomicPublicationSecurityCache",
+          }
+          passed = re.findall(r"^--- PASS: (\w+) \(", body, re.MULTILINE)
+          if set(passed) != expected or len(passed) != len(expected) or re.search(r"--- (SKIP|FAIL):", body):
+              raise SystemExit("all four exact publication contracts must pass without skips")
+          PY
+      - name: Preserve raw observation
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: windows-atomic-publication
+          path: ${{ runner.temp }}/windows-atomic-evidence
+          if-no-files-found: error

.github/workflows/qoder-native-research.yml

@@ -0,0 +1,49 @@
+name: Qoder Pinned Native Research
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/qoder-native-research.yml'
+      - 'scripts/research-qoder-native.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/test_qoder_native_research.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/test_native_client_research.py'
+      - 'scripts/run-native-client-matrix.py'
+      - 'scripts/native_client_draft.py'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: qoder-native-research-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  research:
+    name: Qoder 1.1.78 version help and empty list
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Verify inert research safety contracts
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_native_client_research.py'
+          python3 -m unittest discover -s scripts -p 'test_qoder_native_research.py'
+      - name: Capture pinned genuine research in a fresh credential-free profile
+        env:
+          AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python3 scripts/research-qoder-native.py --output '${{ runner.temp }}/qoder-native-research'
+      - name: Upload research including failed probes
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: qoder-1.1.78-precode-research-linux-amd64
+          path: ${{ runner.temp }}/qoder-native-research/
+          if-no-files-found: error
+          retention-days: 14