chore(locket): catch feat/locket-pro up to dev (merge-conflict resolution)

.dependency-cruiser.js

@@ -0,0 +1,121 @@
+/**
+ * dependency-cruiser — the STANDING GATE for the architectural boundaries we keep
+ * re-establishing by hand in review (layering, engine DIP, dead code, cycles, dep hygiene).
+ *
+ * AGGRESSIVE by design: rules are strict and at `error`. It sees the IMPORT GRAPH, not values —
+ * so it enforces "a screen may not import a concrete engine service" (the SO2/SO4 class, at the
+ * bad import) and "utils/services may not import UI" (the DR1 backward-layering class), but it
+ * does NOT catch the `engine === 'litert'` VALUE branch (an ESLint no-restricted-syntax rule
+ * guards that) or DRY drift / logic bugs. Complements the hygiene standard; does not replace it.
+ *
+ * The tree is CLEAN — zero violations, no baseline file. Every rule is fully enforced with no
+ * exceptions; any new violation fails `npm run depcruise` (CI + pre-push). If you ever must adopt
+ * a new strict rule onto legacy debt, baseline it (`depcruise --output-type baseline >
+ * .dependency-cruiser-known-violations.json` + run the gate with `--ignore-known`) and burn it
+ * down — never regenerate a baseline to hide a fresh violation.
+ */
+module.exports = {
+  forbidden: [
+    // ── Architecture: layering + DIP ──────────────────────────────────────────
+    {
+      name: 'no-circular',
+      severity: 'error',
+      comment: 'Import cycles make load order undefined and desync-prone. Break the cycle (import the concrete module, not the barrel; extract shared state down a layer).',
+      from: {},
+      to: { circular: true },
+    },
+    {
+      name: 'no-backward-layering-core',
+      severity: 'error',
+      comment: 'Core (utils/services/stores/types/constants/config) must not import UI (screens/components/navigation). If a screen owns logic the core needs, move the logic DOWN (see DR1: parseModelOutput → utils).',
+      from: { path: '^src/(utils|services|stores|types|constants|config)/' },
+      to: { path: '^src/(screens|components|navigation)/' },
+    },
+    {
+      name: 'utils-stay-pure',
+      severity: 'error',
+      comment: 'src/utils is the zero-IO pure layer — it must not depend on services or stores. Pure logic here is unit-testable without mocking I/O (hygiene §A).',
+      from: { path: '^src/utils/' },
+      to: { path: '^src/(services|stores)/', pathNot: '^src/utils/' },
+    },
+    {
+      name: 'engine-dip-no-concrete-in-ui',
+      severity: 'error',
+      comment: 'UI (screens/components) must depend on the engine ABSTRACTION (services/engines), never a concrete engine service (services/litert, services/llm). Branching on a concrete engine in a caller is the DIP violation we keep fixing (SO2/SO4). Route through services/engines.',
+      from: { path: '^src/(screens|components)/' },
+      to: { path: '^src/services/(litert|llm)(/|\\.|$)' },
+    },
+    {
+      name: 'components-are-leaf-ui',
+      severity: 'error',
+      comment: 'Reusable components must not import screens or navigation — a leaf UI piece depending on a whole screen inverts the dependency and creates cycles. Lift shared bits into components/ or pass them in as props.',
+      from: { path: '^src/components/' },
+      to: { path: '^src/(screens|navigation)/' },
+    },
+    // ── Dead code ─────────────────────────────────────────────────────────────
+    {
+      name: 'no-orphans',
+      severity: 'error',
+      comment: 'Orphan module (no importers, imports nothing relevant) — dead code. Confirm with grep, then delete (the standing dead-code gate that retires the manual recon).',
+      from: {
+        orphan: true,
+        pathNot: [
+          '\\.(d\\.ts)$',
+          '(^|/)index\\.(ts|tsx)$', // barrel/entry files
+          '^src/types/', // type barrels are legitimately import-only
+          '^src/(bootstrap|shims|config)/', // wiring/shim/config shells reached outside the graph
+        ],
+      },
+      to: {},
+    },
+    // ── Test / build hygiene ──────────────────────────────────────────────────
+    {
+      name: 'not-to-test-from-prod',
+      severity: 'error',
+      comment: 'Production code (src) must not import test files or test utilities — that ships test-only code (and its mocks) into the app bundle.',
+      from: { path: '^src/', pathNot: '\\.(test|spec)\\.[jt]sx?$' },
+      to: { path: '(\\.(test|spec)\\.[jt]sx?$|^(__tests__|__mocks__)/)' },
+    },
+    {
+      name: 'not-to-dev-dep',
+      severity: 'error',
+      comment: 'Production code (src) must not import a devDependency — it will be missing in the release bundle. Move the package to dependencies, or the import out of src.',
+      from: { path: '^src/', pathNot: '\\.(test|spec)\\.[jt]sx?$' },
+      to: { dependencyTypes: ['npm-dev'], pathNot: '(@types/|typescript$)' },
+    },
+    {
+      name: 'no-phantom-deps',
+      severity: 'error',
+      comment: 'Imports a package that is not declared in package.json (a phantom/transitive dependency) — it breaks the moment the transitive graph changes. Declare it explicitly.',
+      from: {},
+      to: {
+        dependencyTypes: ['unknown', 'undetermined', 'npm-no-pkg', 'npm-unknown'],
+        // Known non-resolvable-by-cruiser but LEGITIMATE: whisper.rn IS declared (^0.5.5) but the
+        // `.rn` name defeats cruiser's resolver; @offgrid/pro is the private open-core submodule
+        // wired via metro haste through the ONE bootstrap loader (loadProFeatures) — intentional,
+        // not a phantom dep. Neither is real debt, so exclude rather than baseline.
+        pathNot: '(^whisper\\.rn(/|$)|^@offgrid/pro(/|$))',
+      },
+    },
+    {
+      name: 'no-deprecated-core',
+      severity: 'warn',
+      comment: 'Depends on a deprecated Node core module (e.g. punycode) — will break on a future runtime. Replace it.',
+      from: {},
+      to: { dependencyTypes: ['core'], path: '^(punycode|domain|constants|sys|_linklist|_stream_wrap)$' },
+    },
+  ],
+  options: {
+    doNotFollow: { path: 'node_modules' },
+    tsPreCompilationDeps: true,
+    tsConfig: { fileName: 'tsconfig.json' },
+    enhancedResolveOptions: {
+      exportsFields: ['exports'],
+      conditionNames: ['import', 'require', 'node', 'default', 'types'],
+      extensions: ['.js', '.jsx', '.ts', '.tsx', '.json'],
+    },
+    reporterOptions: {
+      text: { highlightFocused: true },
+    },
+  },
+};

.eslintrc.js

@@ -1,10 +1,18 @@
 module.exports = {
   root: true,
-  extends: '@react-native',
+  extends: [
+    '@react-native',
+    // SonarJS: Sonar-grade bug/smell detection in normal lint — free, local, and it covers
+    // PRO too (pro has no cloud Sonar project; a private cloud project is paid-by-LOC). Most
+    // rules stay at `error` (recommended default) as a forward guard; the handful already
+    // tripped on legacy code are `warn` below with a logged burn-down (GAPS_BACKLOG).
+    'plugin:sonarjs/recommended-legacy',
+  ],
   plugins: [
     'react-native',
     'react',
     'react-hooks',
+    'sonarjs',
   ],
   env: {
     jest: true,
@@ -29,6 +37,10 @@ module.exports = {
     'no-empty': 'error',
     'no-else-return': 'error',
     'prefer-template': 'error',
+    // Dead-branch killers (the "AI leftover" class) — untyped, cheap, high signal, zero current hits.
+    'no-unreachable': 'error',
+    'no-constant-condition': ['error', { checkLoops: false }],
+    'no-constant-binary-expression': 'error',
     complexity: ['error', 20],
     'max-lines-per-function': ['error', 350],
     'max-lines': ['error', 500],
@@ -43,6 +55,20 @@ module.exports = {
     'react-native/no-color-literals': 'error',
     'react-native/no-raw-text': 'error',
     'react-native/no-single-element-style-arrays': 'error',
+
+    // SonarJS — every rule stays at the recommended `error` (a real forward guard on new code)
+    // EXCEPT the two handled here:
+    //  - no-duplicate-string OFF: it fights RN styling — 'space-between'/'center'/'row' and color
+    //    literals repeat by design across StyleSheet objects; a constant per style value is noise,
+    //    not clarity. The one low-value SonarJS rule for this codebase.
+    //  - the rest are `warn` (already tripped on legacy core; burn-down in docs/GAPS_BACKLOG.md,
+    //    ratchet each back to `error` as its count hits zero).
+    'sonarjs/no-duplicate-string': 'off',
+    'sonarjs/prefer-single-boolean-return': 'warn',
+    'sonarjs/no-nested-template-literals': 'warn',
+    'sonarjs/no-collapsible-if': 'warn',
+    'sonarjs/prefer-immediate-return': 'warn',
+    'sonarjs/no-duplicated-branches': 'warn',
   },
   overrides: [
     {
@@ -56,6 +82,11 @@ module.exports = {
         'react-native/no-inline-styles': 'off',
         'react-native/no-raw-text': 'off',
         'react-native/no-color-literals': 'off',
+        // Duplicate test bodies (identical arrange/act across cases) are acceptable and clearer
+        // than over-DRYing tests; the real-bug SonarJS rules (mischeck, unused-collection, etc.)
+        // stay ON for tests — they caught a tautology assertion + a dead collection here.
+        'sonarjs/no-identical-functions': 'off',
+        'sonarjs/cognitive-complexity': 'off',
       },
     },
   ],

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Setup Java
@@ -39,15 +39,29 @@ jobs:
 
   typecheck:
     runs-on: ubuntu-latest
+    env:
+      PRO_SUBMODULE_PAT: ${{ secrets.PRO_SUBMODULE_PAT }}
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Check out pro submodule (private; skipped on open-core forks)
+        # tsc sees __tests__/pro/* which import @offgrid/pro/*; without the submodule those resolve
+        # to nothing (TS2307) and typecheck fails. Pull it when the PAT is present (this org's CI);
+        # forks without the secret skip it and tsconfig excludes the pro paths.
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        env:
+          PRO_PAT: ${{ env.PRO_SUBMODULE_PAT }}
+        run: |
+          git config --global url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf "https://github.com/"
+          git submodule update --init --recursive pro
+          git config --global --unset url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf || true
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Install dependencies
@@ -56,8 +70,51 @@ jobs:
       - name: Type check
         run: npx tsc --noEmit
 
+  architecture:
+    # Standing gates: dependency-cruiser (layering, engine DIP, import cycles, orphans — 0 violations,
+    # no baseline) + knip (dead files/exports/types/deps — 0 issues). Both fail on anything NEW.
+    runs-on: ubuntu-latest
+    env:
+      PRO_SUBMODULE_PAT: ${{ secrets.PRO_SUBMODULE_PAT }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Check out pro submodule (private; skipped on open-core forks)
+        # knip/depcruise scan pro-importing code; without the submodule their reachability graph is
+        # incomplete (false unused/orphan reports). Pull it when the PAT is present; forks skip it.
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
+        env:
+          PRO_PAT: ${{ env.PRO_SUBMODULE_PAT }}
+        run: |
+          git config --global url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf "https://github.com/"
+          git submodule update --init --recursive pro
+          git config --global --unset url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf || true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Dependency-cruiser (architecture gate)
+        run: npm run depcruise
+
+      - name: knip (dead-code gate)
+        run: npm run knip
+
   test:
     runs-on: macos-latest
+    env:
+      # Exposed at the job level so the step `if:` below can read it: the `secrets` context
+      # is NOT allowed inside an `if:` condition (GitHub rejects the whole workflow at
+      # startup — a 0-second failure), but the `env` context IS. This one line being an
+      # `if: ${{ secrets.* }}` is what took the entire CI pipeline down.
+      PRO_SUBMODULE_PAT: ${{ secrets.PRO_SUBMODULE_PAT }}
 
     steps:
       - name: Checkout code
@@ -68,9 +125,9 @@ jobs:
         # pro/ submodule so the pro-dependent suites (TTS/MCP/audio) run against the REAL
         # package — a green run then actually exercises pro, not a stub. Forks without the
         # secret skip this: proExists=false and jest runs the open-core suite instead.
-        if: ${{ secrets.PRO_SUBMODULE_PAT != '' }}
+        if: ${{ env.PRO_SUBMODULE_PAT != '' }}
         env:
-          PRO_PAT: ${{ secrets.PRO_SUBMODULE_PAT }}
+          PRO_PAT: ${{ env.PRO_SUBMODULE_PAT }}
         run: |
           git config --global url."https://x-access-token:${PRO_PAT}@github.com/".insteadOf "https://github.com/"
           git submodule update --init --recursive pro
@@ -79,7 +136,13 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          # Node 26. The RAG/knowledge-base suites run a REAL in-memory database via node's
+          # built-in `node:sqlite` (__tests__/harness/sqliteFake.ts). That module is absent on
+          # Node 20 and flag-gated on Node 22. On Node 24 it loads but its native teardown
+          # SEGFAULTs the process under jest's --forceExit (exit 139) — reproduced locally: the
+          # full suite exits 139 on Node 24 and exits 0 on Node 26. Node 26's node:sqlite fixes
+          # that teardown crash, so the test runtime is pinned to 26.
+          node-version: '26'
           cache: 'npm'
 
       - name: Setup Java
@@ -92,7 +155,7 @@ jobs:
         run: npm ci
 
       - name: Run Jest tests
-        run: npx jest --coverage --forceExit
+        run: npx jest --coverage --forceExit --runInBand
 
       - name: Install Android NDK
         # Configuring the native modules (op-sqlite etc.) needs the pinned NDK; the macOS
@@ -147,7 +210,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
 
       - name: Setup Java
@@ -173,3 +236,8 @@ jobs:
 
       - name: Build Android Release
         run: cd android && ./gradlew assembleRelease
+
+  # NOTE: SonarCloud runs via Automatic Analysis (SonarCloud-side, on the public core project) —
+  # no CI job. A CI scan would only add coverage import, which Codecov (in the `test` job) already
+  # does, so it'd be redundant complexity. Pro is scanned locally by eslint-plugin-sonarjs (free,
+  # private, no leak). See docs/GAPS_BACKLOG.md.

.github/workflows/release-ios.yml

@@ -168,6 +168,22 @@ jobs:
           git commit -m "chore: update AltStore source for v${{ env.VERSION }} [skip ci]"
           git push
 
+      # Announce the iOS release in Slack: the GitHub release link + its notes. iOS doesn't
+      # generate release-notes.md itself (Android creates the shared vX.Y.Z release with notes),
+      # so pull the notes from the release body best-effort. Fail-soft: notify script always
+      # exits 0. Needs secret SLACK_WEBHOOK_URL (an Incoming Webhook, channel-bound).
+      - name: Announce release in Slack
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          PRODUCT: Off Grid AI Mobile (iOS)
+          VERSION: ${{ env.VERSION }}
+          NOTES_FILE: release-notes.md
+        run: |
+          gh release view "v${VERSION}" --json body -q .body > release-notes.md 2>/dev/null || true
+          node scripts/notify-slack-release.mjs
+
       - name: Cleanup keychain
         if: always()
         run: |

.github/workflows/release.yml

@@ -168,3 +168,15 @@ jobs:
           ORG_GRADLE_PROJECT_OFFGRID_UPLOAD_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           ORG_GRADLE_PROJECT_OFFGRID_UPLOAD_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: bundle exec fastlane android release
+
+      # Announce the release in Slack: the GitHub release link + the notes generated above.
+      # Fail-soft (notify script always exits 0), so a Slack outage never fails a release.
+      # Needs secret SLACK_WEBHOOK_URL (an Incoming Webhook, channel-bound). No secret => no-op.
+      - name: Announce release in Slack
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          PRODUCT: Off Grid AI Mobile (Android)
+          VERSION: ${{ env.NEW_VERSION }}
+          NOTES_FILE: release-notes.md
+        run: node scripts/notify-slack-release.mjs

.gitignore

@@ -93,3 +93,9 @@ docs/TRACTION_KNOWLEDGE_BASE.md
 /image-*.png
 # Local marketing drafts (not part of the app)
 marketing/
+
+# Personal device-test commentary (raw voice, not for the repo)
+docs/DEVICE_SESSION_COMMENTARY.md
+
+# Device wire-capture logs (raw, large, session-specific — kept locally, not versioned)
+docs/wire-captures/

.husky/pre-push

@@ -49,6 +49,9 @@ if [ -n "$PUSHED_JS" ]; then
 
   echo "▶ JS/TS tests (related to changed files)..."
   echo "$PUSHED_JS" | tr '\n' '\0' | xargs -0 npx jest --findRelatedTests --passWithNoTests
+
+  echo "▶ Architecture gate (dependency-cruiser)..."
+  npm run depcruise
 fi
 
 if [ -n "$PUSHED_SWIFT" ]; then