Enhance tool evidence display and improve light mode contrast

.aiassistant/rules/all-the-code-is-OURS.md

@@ -19,7 +19,7 @@ przyjmujesz zasadę: "All the code is ours"
    konfigurację
    lub (w ostateczności!) dostarcz jasny, udokumentowany workaround.
 
-„All the code is ours” — traktuj całe repo VetCoders jak własne i wspólne: jeśli coś nie działa (lint/testy/build/UX),
+„All the code is ours” — traktuj całe repo vetcoders jak własne i wspólne: jeśli coś nie działa (lint/testy/build/UX),
 nie szukaj winnego ani „czyjego to plik”, tylko bierz ownership, zdiagnozuj przyczynę, napraw to minimalnie i trwale,
 dodaj test zabezpieczający i doprowadź projekt do zielonego stanu. Pamiętaj: kodujemy dla lekarzy weterynarii —
 stabilność, przewidywalność i brak regresji są ważniejsze niż wymówki i skróty.

.env.debug.example

@@ -1,6 +1,6 @@
-# CodeScribe Env Debug / Developer (exhaustive)
+# Codescribe Env Debug / Developer (exhaustive)
 # Copy to ~/.codescribe/.env or point via CODESCRIBE_ENV_PATH
-# This file lists ALL known env vars used by CodeScribe (runtime + build + tests).
+# This file lists ALL known env vars used by Codescribe (runtime + build + tests).
 # Values shown are safe defaults/examples. Remove what you don't need.
 
 # =============================================================================
@@ -25,7 +25,7 @@
 # CODESCRIBE_MODEL_PATH=/path/to/model                             # Override embedded model
 LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8                          # Local model name (if multiple)
 WHISPER_MODEL=mlx-community/whisper-large-v3-mlx                   # External HF model name
-WHISPER_LANGUAGE=pl                                                 # pl | en (auto maps to pl)
+WHISPER_LANGUAGE=auto                                               # auto | pl | en
 USE_LOCAL_STT=1                                                     # 1=prefer local, 0=cloud only
 # CODESCRIBE_MODEL_DIR=...                                          # Set by build.rs (internal)
 

.env.example

@@ -1,4 +1,4 @@
-# CodeScribe — OPTIONAL power-user overrides (~/.codescribe/.env)
+# Codescribe — OPTIONAL power-user overrides (~/.codescribe/.env)
 #
 # You do NOT need this file. settings.json (managed by the GUI) is the source of
 # truth and can express every setting below. This file is only a power-user
@@ -19,10 +19,13 @@
 # USE_LOCAL_STT=1
 # LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8
 # WHISPER_MODEL=whisper-large-v3-turbo-mlx-q8
-# WHISPER_LANGUAGE=pl
+# WHISPER_LANGUAGE=auto
 # CODESCRIBE_TOGGLE_FINAL_PASS=1        # 0 = restore preview-only toggle stop path
-# CODESCRIBE_WHISPER_INITIAL_PROMPT=CodeScribe, LibraxisAI, Docker, GitHub
+# CODESCRIBE_LAYERED_TRANSCRIPTION=off  # off | phase1 | phase2 | phase3 | phase4
+# CODESCRIBE_WHISPER_INITIAL_PROMPT=Codescribe, LibraxisAI, Docker, GitHub
+# CODESCRIBE_STT_INITIAL_PROMPT_ENABLED=0  # 1 = opt in to runtime lexicon initial_prompt
 # CODESCRIBE_MODEL_PATH=/path/to/whisper/model  # runtime fallback / dev override
+# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # unload Whisper from GPU/host memory after N s idle (0 = never)
 
 # =============================================================================
 # CLOUD STT (OPTIONAL)
@@ -76,7 +79,7 @@
 # =============================================================================
 # QUICK_NOTES_ENABLED=0
 # QUICK_NOTES_SAVE_ONLY=0
-# CODESCRIBE_NOTES_DIR=~/Git/vista/notes
+# CODESCRIBE_NOTES_DIR=~/Documents/notes
 
 # =============================================================================
 # AI FORMATTING / ASSISTIVE
@@ -89,6 +92,7 @@
 # AI_MAX_TOKENS=1200
 # AI_ASSISTIVE_MAX_TOKENS=2000
 # AGENT_ENTER_SENDS=1
+# AGENT_WORKSPACE_ROOTS=~/Git            # colon-separated roots the agent's list_projects tool scans
 
 # Shared LLM defaults (endpoints/models are config; keys live in Keychain)
 # LLM_ENDPOINT=https://api.openai.com/v1/responses
@@ -109,11 +113,13 @@
 
 # Assistive overrides
 # LLM_ASSISTIVE_ENDPOINT=https://api.openai.com/v1/responses
+# LLM_ASSISTIVE_PROVIDER=openai-responses  # openai-responses | anthropic-messages
 # LLM_ASSISTIVE_MODEL=gpt-5.5
 # LLM_ASSISTIVE_TEMPERATURE=0.3
 
 # Formatting overrides
 # LLM_FORMATTING_ENDPOINT=https://api.openai.com/v1/responses
+# LLM_FORMATTING_PROVIDER=openai-responses  # openai-responses | anthropic-messages
 # LLM_FORMATTING_MODEL=gpt-4.1
 # LLM_FORMATTING_TEMPERATURE=0.1
 
@@ -145,9 +151,18 @@
 # CODESCRIBE_STREAM_NOVELTY=0.20
 # CODESCRIBE_STREAM_DISABLE_EMBEDDINGS=1
 # CODESCRIBE_STREAM_FORCE_EMBEDDINGS=1
+# CODESCRIBE_EMBEDDER_IDLE_UNLOAD_SECS=300  # unload MiniLM embedder from GPU/host memory after N s idle (0 = never)
 # CODESCRIBE_STREAM_LEXICON=1
 # CODESCRIBE_STREAM_LOG=1
 # CODESCRIBE_STREAM_LOG_PATH=/tmp/codescribe_stream.log
+# CODESCRIBE_STT_THERMAL_GOVERNOR_ENABLED=1
+# CODESCRIBE_STT_MIN_INFER_INTERVAL_MS=90
+# CODESCRIBE_STT_COMMIT_MIN_INTERVAL_MS=180
+# CODESCRIBE_STT_REFINE_MIN_INTERVAL_MS=240
+# CODESCRIBE_STT_THERMAL_NOMINAL_MULT=0.0
+# CODESCRIBE_STT_THERMAL_FAIR_MULT=1.0
+# CODESCRIBE_STT_THERMAL_SERIOUS_MULT=2.0
+# CODESCRIBE_STT_THERMAL_CRITICAL_MULT=4.0
 
 # =============================================================================
 # VAD (SILERO)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,6 +1,6 @@
 ---
 name: Bug report
-about: Report a reproducible defect in CodeScribe
+about: Report a reproducible defect in codescribe
 title: "[bug] "
 labels: ["bug", "triage"]
 assignees: []
@@ -12,7 +12,7 @@ Describe the defect in one or two sentences.
 
 ## Environment
 
-- CodeScribe version:
+- Codescribe version:
 - macOS version:
 - Device (Apple Silicon model):
 - Install mode (`make install`, `.app`, other):

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,7 +4,7 @@ What changed, and why?
 
 ## User Impact
 
-What does this improve or prevent for a real CodeScribe user?
+What does this improve or prevent for a real codescribe user?
 
 ## Runtime Impact
 

.github/workflows/pages.yml

@@ -22,11 +22,11 @@ jobs:
     name: Build landing artifact
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/configure-pages@v5
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
         with:
           enablement: true
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: docs/landing
 
@@ -39,4 +39,4 @@ jobs:
     needs: build
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/release.yml

@@ -18,11 +18,20 @@ jobs:
     name: Build, notarize, and publish DMG
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.tag_name || github.ref }}
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+
+      - name: Install XcodeGen
+        # scripts/build-app.sh preflights `require xcodegen` — the app's
+        # .xcodeproj is generated, not committed, so the release runner needs it
+        # or the DMG build dies before xcodebuild. (cargo, uniffi-bindgen and
+        # xcodebuild are already provided: rust-toolchain installs cargo,
+        # uniffi-bindgen is built from `cargo build -p codescribe-ffi`, and
+        # xcodebuild ships with the macOS runner image.)
+        run: brew install xcodegen
 
       - name: Validate signing secrets
         env:
@@ -62,7 +71,7 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
         run: |
-          xcrun notarytool store-credentials "CodeScribeNotary" \
+          xcrun notarytool store-credentials "CodescribeNotary" \
             --apple-id "$APPLE_ID" \
             --team-id "$APPLE_TEAM_ID" \
             --password "$APPLE_APP_SPECIFIC_PASSWORD"
@@ -71,12 +80,12 @@ jobs:
         env:
           CODESCRIBE_CODESIGN_IDENTITY: ${{ secrets.CODESCRIBE_CODESIGN_IDENTITY }}
           CODESCRIBE_BUNDLE_ID: ${{ vars.CODESCRIBE_BUNDLE_ID || 'com.vetcoders.codescribe' }}
-          NOTARY_PROFILE: CodeScribeNotary
+          NOTARY_PROFILE: CodescribeNotary
         run: make release-dmgs
 
       - name: Publish GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ inputs.tag_name || github.ref_name }}
-          files: CodeScribe_*.dmg
+          files: Codescribe_*.dmg
           generate_release_notes: true

.github/workflows/rust.yml

@@ -1,10 +1,10 @@
 # Rust Code Quality CI
-# Created by M&K (c)2026 VetCoders
+# Created by Vetcoders (c)2026
 #
-# NOTE: Full build requires macOS with Swift 6.0 (CoreML, Metal).
-# GitHub runners have Swift 5.10, so we only run format checks here.
-# Full quality gate (clippy, tests) runs locally via: make check
-# Or via pre-commit hooks: make hooks
+# Runs on self-hosted macOS runners (Swift 6.0 / CoreML / Metal available).
+# format: cargo fmt --check
+# quality: cargo clippy -D warnings + cargo test (workspace).
+# Full local gate (incl. real-API / heavy e2e tests) still via: make check
 
 name: Rust Quality
 
@@ -24,24 +24,38 @@ env:
 jobs:
   format:
     name: Format Check
-    runs-on: self-hosted
+    runs-on: [self-hosted, macOS]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt
 
       - name: cargo fmt --check
         run: cargo fmt --all -- --check
 
-  # NOTE: clippy and check disabled - requires macOS + Swift 6.0
-  # Run locally: make lint
-  #
-  # To enable full CI, use a self-hosted macOS runner:
-  # quality:
-  #   runs-on: [self-hosted, macos, arm64]
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - run: cargo clippy -- -D warnings
-  #     - run: cargo test --lib
+  quality:
+    name: Clippy + Tests
+    runs-on: [self-hosted, macOS]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          components: clippy
+
+      - name: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      # Runs the default (non-#[ignore]) workspace test set.
+      # CODESCRIBE_DISABLE_KEYCHAIN=1: keychain-backed tests must bypass the
+      #   macOS Keychain (no interactive unlock / signed host on the runner) —
+      #   see core/config/keychain.rs and the Makefile `test` target.
+      # #[ignore]-gated tests (real LLM APIs, Whisper/STT models, audio devices,
+      #   live SSE) are intentionally NOT run here — they need secrets/hardware
+      #   absent on CI and stay behind `make test` / `make test-e2e-real` locally.
+      - name: cargo test --workspace
+        env:
+          CODESCRIBE_DISABLE_KEYCHAIN: "1"
+        run: cargo test --workspace

.github/workflows/semgrep.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install Semgrep
         shell: bash

.gitignore

@@ -6,8 +6,7 @@ dist/
 *.app/
 target-noembed/
 
-# Cargo lockfile (per latest GitHub security recommendations for libraries/apps)
-Cargo.lock
+# Cargo.lock is tracked for reproducible app builds and cargo-audit evidence.
 __pycache__/
 *.pyc
 .venv/
@@ -65,7 +64,7 @@ nohup.out.backup
 *codex*
 /agents
 
-# CodeScribe
+# Codescribe
 .codescribe/state/
 codescribe_memory_*.md
 codescribe_memory_*.json

.pre-commit-config.yaml

@@ -1,8 +1,8 @@
-# Pre-commit hooks for CodeScribe (Pure Rust)
-# Install: pipx install pre-commit && pre-commit install --hook-type pre-commit --hook-type pre-push
+# Pre-commit hooks for Codescribe (Pure Rust)
+# Install: pipx install pre-commit && make hooks
 # Run: pre-commit run --all-files
 #
-# Created by M&K (c)2026 VetCoders
+# Created by Vetcoders (c)2026
 
 minimum_pre_commit_version: "3.5.0"
 
@@ -62,3 +62,12 @@ repos:
         language: system
         pass_filenames: false
         stages: [pre-push]
+
+  # Commit provenance (commit-msg stage)
+  - repo: local
+    hooks:
+      - id: commit-msg-provenance
+        name: commit message provenance
+        entry: scripts/commit-msg-provenance.sh
+        language: system
+        stages: [commit-msg]

.prettierignore

@@ -17,9 +17,16 @@
 **/.pytest_cache/**
 **/.venv/**
 **/.DS_Store
+**/AGENTS.md
+**/CLAUDE.md
+**/*codex*.md
 **/claude_memory_*.md
-**/CodeScribe_memory_*.md
+**/Codescribe_memory_*.md
+**/logs/**
 **/node_modules/**
+**/build/**
+**/.build/**
+**/DerivedData/**
 **/target/**
 **/target-noembed/**
 **/dist/**
@@ -38,3 +45,4 @@
 **/*.mp3
 **/*.m4a
 **/*.zip
+**/*.xcassets/**