fix: harden trace semantics and project quality

.github/workflows/python-runtime-matrix.yml

@@ -1,4 +1,4 @@
-name: Python Runtime Matrix
+name: Quality and Python Runtime Matrix
 
 on:
   push:
@@ -11,6 +11,79 @@ permissions:
   contents: read
 
 jobs:
+  quality-and-bundle:
+    name: Frontend, Rust quality, and Windows bundle
+    runs-on: windows-latest
+    timeout-minutes: 45
+    env:
+      CARGO_TERM_COLOR: always
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          architecture: x64
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          shared-key: windows-quality
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Verify development environment
+        run: npm run doctor
+
+      - name: Build frontend assets
+        run: npm run build
+
+      - name: Test frontend units
+        run: npm test
+
+      - name: Install Playwright Chromium
+        run: npx playwright install chromium
+
+      - name: Test browser flows
+        run: npm run test:e2e
+
+      - name: Upload Playwright failure traces
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-failure-traces
+          path: test-results
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Audit production dependencies
+        run: npm audit --registry=https://registry.npmjs.org --omit=dev
+
+      - name: Check Rust formatting
+        run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
+
+      - name: Lint Rust targets
+        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
+
+      - name: Build Windows Tauri bundle
+        run: npx tauri build --bundles nsis
+
   windows-python-runtime:
     name: Windows Python ${{ matrix.python-version }}
     runs-on: windows-latest
@@ -36,7 +109,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -56,20 +128,11 @@ jobs:
       - name: Verify selected Python runtime
         shell: pwsh
         run: |
-          python --version
+          npm run doctor
           where.exe python
           where.exe python3.dll
           python -c "import platform, sys; print(sys.version); print(platform.architecture()[0])"
 
-      - name: Install frontend dependencies
-        run: npm ci
-
-      - name: Build frontend assets
-        run: npm run build
-
-      - name: Compile Rust test binaries
-        run: cargo test --manifest-path src-tauri/Cargo.toml --no-run
-
       - name: Test Rust backend
         run: npm run test:backend
 

AGENTS.md

@@ -0,0 +1,31 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+PyWeave is a Tauri desktop application with a React/TypeScript frontend and a Rust/PyO3 backend. Frontend components and domain logic live in `src/`; colocate Vitest files as `*.test.ts`. Native commands, Python tracing, policy enforcement, and inline Rust tests live in `src-tauri/src/`. Playwright scenarios belong in `tests/e2e/`, developer utilities in `scripts/`, and Tauri capabilities and application icons under `src-tauri/capabilities/` and `src-tauri/icons/`. Treat `dist/`, `target/`, `test-results/`, and `node_modules/` as generated output.
+
+## Build, Test, and Development Commands
+
+- `npm install`: install JavaScript dependencies (`npm ci` in clean/CI environments).
+- `npm run doctor`: verify Node.js, npm, Rust/Cargo, and Python 3 prerequisites.
+- `npm run dev`: run the Vite frontend at `127.0.0.1:1420`.
+- `npm run dev:desktop`: launch the complete Tauri application.
+- `npm run build`: type-check with `tsc`, then build frontend assets.
+- `npm run tauri -- build`: produce desktop bundles under `src-tauri/target/`.
+- `npm run test:all`: run the build, Vitest, Playwright, and Rust test suites.
+
+## Coding Style & Naming Conventions
+
+TypeScript is strict and targets ES2022. Follow the existing style: two-space indentation, double quotes, semicolons, trailing commas, `PascalCase` React components, `camelCase` functions/variables, and `UPPER_SNAKE_CASE` constants. Rust uses standard `rustfmt` formatting, four-space indentation, `snake_case` functions/modules, and `CamelCase` types. Keep tracing and policy logic separate from UI state; prefer immutable inputs and explicit errors. No ESLint or Prettier command is configured, so do not claim formatting checks that do not exist.
+
+## Testing Guidelines
+
+Use behavior-focused Vitest `describe`/`it` names and colocate unit tests with their modules. Name browser tests `*.spec.ts`; keep Rust unit tests in `#[cfg(test)]` modules with descriptive `snake_case` names. Run `npm test`, `npm run test:e2e`, or `npm run test:backend` for focused checks. There is no coverage threshold; new behavior should still receive regression coverage. Backend tests enforce a 60-second timeout, and CI validates Python 3.10-3.13 on Windows.
+
+## Commit & Pull Request Guidelines
+
+Follow the repository's Conventional Commit pattern: `type: concise imperative summary`, for example `fix: support Python 3.10 runtime`. Common types are `feat`, `fix`, `test`, `ci`, and `chore`. Keep commits focused. Pull requests should explain behavior and architecture changes, list verification commands, link relevant issues, and include screenshots for UI changes.
+
+## Security & Configuration
+
+PyWeave executes Python locally. Keep restricted execution enabled by default; set `PYWEAVE_ALLOW_UNRESTRICTED_PYTHON=1` only for trusted local code. Never commit credentials or weaken worker timeout, snapshot-size, or trace-limit protections without documenting the risk.