UI: Center align coverage columns and standardize naming

.delegate/launch.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+export DELEGATE_LABEL="agy-perms-hooks"
+exec 'agy' '-i' 'SPEC: Make Matrix the only In-use view for Permissions + Hooks
+
+1. OBJECTIVE
+Remove the Cards/Board view options from the Permissions In-use page and the Hooks In-use page
+so the Matrix view is the sole, always-rendered view. Delete the now-dead code.
+
+2. CONTEXT
+- Repo root = your worktree CWD (a git worktree off `main`). All paths below are relative to it.
+- You own ONLY these two features: `frontend/src/features/permissions/**` and
+  `frontend/src/features/hooks/**`. Do NOT touch any other feature, `components/`, `lib/`, or
+  the Python backend.
+- The Matrix components ALREADY EXIST and must be kept:
+  `frontend/src/features/permissions/components/PermissionsMatrixView.tsx`
+  `frontend/src/features/hooks/components/HooksMatrixView.tsx`
+- Shared files you must NOT delete or edit (the orchestrator removes them later, after all
+  branches merge): `frontend/src/components/ViewModeToggle.tsx`,
+  `frontend/src/lib/usePersistentViewMode.ts`.
+- node_modules is symlinked into `frontend/node_modules` for you; npm commands work from repo root.
+
+Files that carry the view toggle today:
+  Permissions page: frontend/src/features/permissions/screens/PermissionsInUsePage.tsx
+              hook: frontend/src/features/permissions/model/usePermissionsInUseViewMode.ts (DELETE)
+              dead: frontend/src/features/permissions/components/PermissionCardList.tsx (DELETE)
+                    + any component/i18n/test used ONLY by it
+  Hooks page:  frontend/src/features/hooks/screens/HooksInUsePage.tsx
+              hook: frontend/src/features/hooks/model/useHooksInUseViewMode.ts (DELETE)
+              dead: frontend/src/features/hooks/components/HookCardList.tsx (DELETE)
+                    frontend/src/features/hooks/components/board/HooksBoard.tsx (DELETE whole board/ dir)
+                    + any component/i18n/test used ONLY by those
+
+Per page, do exactly this:
+  a. Remove the <ViewModeToggle> render, the `viewModeOptions` array, the `useXViewMode()`
+     call, and all `viewMode === ...` branching. Render the Matrix component unconditionally
+     wherever rows exist (keep the loading / error / empty-state branches intact).
+  b. KEEP all search + filter UI (FilterBar, any filter/pill menu) — those are NOT view modes.
+     If a filter was gated behind `viewMode === "cards"`, make it always shown.
+  c. Delete the dead view components listed above and any files (subcomponents, tests, i18n
+     `viewModes`/`viewModeAria` keys, unused lucide icon imports like Columns3/Grid2X2) that
+     become unreferenced as a result. No dead code, no unused imports may remain.
+  d. Delete the section'\''s `useXViewMode.ts` hook file and its test if present.
+
+3. DEFINITION OF DONE (I will run these exact checks myself in your worktree)
+- `grep -rn "ViewModeToggle" frontend/src/features/permissions frontend/src/features/hooks` → NO output
+- `grep -rn "usePermissionsInUseViewMode\|useHooksInUseViewMode\|PermissionsInUseViewMode\|HooksInUseViewMode" frontend/src` → NO output
+- `grep -rn "PermissionCardList\|HookCardList\|HooksBoard" frontend/src` → NO output
+- `git status` shows the useXViewMode hooks and the dead components as deleted.
+- `npm run typecheck` exits 0
+- `npm test` passes (update/remove tests that referenced removed views; do NOT weaken unrelated tests)
+- `npm run build` exits 0
+- Manual read: PermissionsInUsePage.tsx and HooksInUsePage.tsx render only the Matrix view; search/filter UI preserved.
+
+4. ESCALATION — stop and ask me (via reverse channel) instead of guessing if:
+- Removing a view forces changing shared/global files outside your two features.
+- A matrix component is missing an affordance the deleted card/board had and it'\''s unclear where it should live.
+- A test failure implies a behavior change you'\''re unsure is intended.
+- The real change is materially bigger than this spec implies.
+
+5. REVERSE CHANNEL — to reach me, run ONE command from your worktree:
+   ./.delegate/notify needs-input "the question or decision you need answered"
+   ./.delegate/notify blocked     "what you are stuck on"
+   ./.delegate/notify done        "summary of what you finished"
+  then STOP AND WAIT at your prompt — do not exit, do not continue. I will review and either
+  confirm or send corrections. After I reply, run `./.delegate/notify resume` before continuing.
+
+6. OUTPUT — on finish: run `./.delegate/notify done "<summary>"`, then STOP AND WAIT. Do not exit.
+
+7. SCOPE BOUNDARY — stay in your worktree; touch only features/permissions and features/hooks
+   (plus their tests). Do NOT edit ViewModeToggle.tsx / usePersistentViewMode.ts / other features /
+   backend. Do NOT push, open PRs, or run any git merge. Make small logical commits on your branch.' '--add-dir' '/Users/hgill/projects/skill-manager-worktrees/agy-perms-hooks' '--dangerously-skip-permissions' '--model' 'gemini-3.1-pro-high'

.delegate/notify

@@ -0,0 +1,55 @@
+#!/bin/sh
+# notify — reverse-channel helper for a DELEGATED agent. Copied into each
+# delegate's worktree as ./.delegate/notify by `spawn`. Run it from the worktree.
+#
+# Usage:
+#   ./.delegate/notify needs-input "the question or decision you need answered"
+#   ./.delegate/notify blocked     "what you are stuck on"
+#   ./.delegate/notify done        "summary of what you finished (orchestrator re-verifies)"
+#   ./.delegate/notify resume      # AFTER the orchestrator replies, before you continue working
+#
+# It does two things so the orchestrator both wakes instantly AND gets full content:
+#   1. sets your herdr agent status (event-driven, ~ms wake) via report-agent
+#   2. writes the full message to ./.delegate/signal (the orchestrator polls this)
+# herdr injects $HERDR_PANE_ID into your pane; $DELEGATE_LABEL is set by spawn.
+#
+# IMPORTANT: a reported `blocked` is sticky and suppresses herdr's real detection
+# until cleared. After the orchestrator answers, run `notify resume` (or it will
+# sit falsely blocked forever).
+
+set -u
+
+kind="${1:-}"
+[ "$#" -gt 0 ] && shift
+msg="${*:-}"
+
+here="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"   # the .delegate dir
+sigfile="$here/signal"
+label="${DELEGATE_LABEL:-delegate}"
+pane="${HERDR_PANE_ID:-}"
+
+report() {  # report <state> <custom-status>
+  [ -n "$pane" ] || return 0
+  herdr pane report-agent "$pane" --source delegate-protocol --agent "$label" \
+    --state "$1" --custom-status "$2" >/dev/null 2>&1 || true
+}
+
+headline() { printf '%s' "$1" | tr '\n' ' ' | cut -c1-72; }
+
+case "$kind" in
+  needs-input)
+    report blocked "NEEDS-INPUT: $(headline "$msg")"
+    printf '<<DELEGATE:NEEDS-INPUT>> %s\n' "$msg" > "$sigfile" ;;
+  blocked)
+    report blocked "BLOCKED: $(headline "$msg")"
+    printf '<<DELEGATE:BLOCKED>> %s\n' "$msg" > "$sigfile" ;;
+  done)
+    # no reportable `done` state; completion rides the file + quiescence
+    printf '<<DELEGATE:DONE>> %s\n' "$msg" > "$sigfile" ;;
+  resume)
+    report working "resumed"
+    : > "$sigfile" ;;
+  *)
+    echo "usage: notify {needs-input|blocked|done|resume} [message]" >&2
+    exit 2 ;;
+esac

.delegate/signal

@@ -0,0 +1 @@
+<<DELEGATE:DONE>> 62 test files passed, 263 tests passed

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+updates:
+  # Frontend (and dev tooling) JavaScript dependencies.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+      radix:
+        patterns:
+          - "@radix-ui/*"
+      testing:
+        patterns:
+          - "@testing-library/*"
+          - "vitest"
+          - "jsdom"
+    commit-message:
+      prefix: chore(deps)
+  # Python runtime + build dependencies.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore(deps)
+  # GitHub Actions used by the CI and Release workflows.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore(ci)

.github/workflows/ci.yml

@@ -36,9 +36,9 @@ jobs:
           - "3.13"
           - "3.14"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -48,19 +48,30 @@ jobs:
           ./.venv/bin/python -m pip install --upgrade pip
           ./.venv/bin/pip install -r requirements.txt
 
+      - name: Install dev dependencies
+        run: ./.venv/bin/pip install -r requirements-dev.txt
+
+      - name: Backend lint
+        run: ./.venv/bin/ruff check skill_manager tests
+
+      - name: Python dependency audit
+        run: |
+          ./.venv/bin/pip install pip-audit
+          ./.venv/bin/pip-audit
+
       - name: Backend compatibility tests
         run: bash scripts/test_backend.sh
 
   frontend-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -73,6 +84,9 @@ jobs:
       - name: Install Node dependencies
         run: npm ci
 
+      - name: Dependency audit
+        run: npm run audit:check
+
       - name: Check version sync
         run: ./.venv/bin/python scripts/sync_version.py --check
 
@@ -115,13 +129,13 @@ jobs:
             runner: ubuntu-24.04-arm
             homebrew: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -155,7 +169,7 @@ jobs:
           bash scripts/validate_homebrew_formula.sh "$VERSION" "$ARTIFACT"
 
       - name: Upload packaged artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: package-smoke-${{ matrix.target }}
           path: .artifacts/release/*

.github/workflows/release.yml

@@ -30,14 +30,14 @@ jobs:
             runner: ubuntu-24.04-arm
             homebrew: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           # Release packaging stays on one stable builder version.
           python-version: "3.11"
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -73,7 +73,7 @@ jobs:
           bash scripts/validate_homebrew_formula.sh "$VERSION" "$ARTIFACT"
 
       - name: Upload packaged artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: release-${{ matrix.target }}
           path: .artifacts/release/*
@@ -83,16 +83,16 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: .artifacts/release
           pattern: release-*
           merge-multiple: true
 
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: .artifacts/release/*
 
@@ -101,14 +101,14 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           # Publishing tooling stays pinned even though runtime compatibility is validated in CI.
           python-version: "3.11"
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -133,14 +133,14 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           # Formula rendering is deterministic on the same stable builder version.
           python-version: "3.11"
 
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: .artifacts/release
           pattern: release-*
@@ -167,7 +167,7 @@ jobs:
         run: ruby -c .artifacts/release/skill-manager.rb
 
       - name: Upload Homebrew formula artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: homebrew-formula
           path: .artifacts/release/skill-manager.rb

.gitignore

@@ -13,3 +13,15 @@ packaging/npm/vendor/
 task_plan.md
 findings.md
 progress.md
+
+# macOS
+.DS_Store
+
+# Local tool state — machine-specific, expensive to rebuild, never shared
+.codegraph/
+.rtk/
+
+# Per-agent instruction files generated by local tooling (rtk init and friends).
+# Shared working agreements belong in CLAUDE.md; these do not.
+.clinerules
+.agents/