Runtime-first Core, persistence, and package boundary cleanup

.github/ISSUE_TEMPLATE/backend_runtime.yml

@@ -1,13 +1,13 @@
 name: Backend or runtime work
-description: Apple container, Docker compatibility, command abstraction, compose, or runtime behavior
+description: Apple container, Docker-compatible runtimes, command orchestration, Compose, or runtime behavior
 labels: ["feature", "backend", "triage"]
 body:
   - type: textarea
     id: runtime-area
     attributes:
       label: Runtime area
       description: What backend, command, data model, or runtime behavior is involved?
-      placeholder: Apple container, Docker, compose, images, networks, volumes, command building...
+      placeholder: Apple container, Docker-compatible runtime, Compose, images, networks, volumes, command previews...
     validations:
       required: true
 
@@ -25,8 +25,8 @@ body:
       label: Research / design checklist
       description: What should be answered before implementation starts?
       placeholder: |
-        - [ ] Inventory affected ContainerCommands and ContainerClient call sites
-        - [ ] Identify Apple container compatibility requirements
+        - [ ] Inventory affected Core.Orchestrator operations and adapter internals
+        - [ ] Identify Apple container runtime requirements
         - [ ] Note Docker or future-backend differences
     validations:
       required: false
@@ -37,8 +37,8 @@ body:
       label: Implementation checklist
       description: What likely needs to change?
       placeholder: |
-        - [ ] Keep CLI actions behind ContainerCommands and ContainerClient
-        - [ ] Put pure decisions in ContainedCore
+        - [ ] Keep CLI actions behind ContainedCore adapter internals
+        - [ ] Route app-owned backend work through Core.Orchestrator
         - [ ] Add focused tests
     validations:
       required: false
@@ -48,7 +48,7 @@ body:
     attributes:
       label: Acceptance criteria
       placeholder: |
-        - [ ] Existing Apple container behavior stays compatible
+        - [ ] Existing Apple container behavior stays intact
         - [ ] SwiftUI does not assemble backend argv inline
         - [ ] Unsupported backend capabilities are handled clearly
     validations:
@@ -57,7 +57,7 @@ body:
   - type: textarea
     id: related
     attributes:
-      label: Related links, blockers, or compatibility notes
+      label: Related links, blockers, or runtime notes
       description: Issues, docs, commands, migration concerns, backend-specific notes, known blockers, or a suggested milestone.
     validations:
       required: false

.github/ISSUE_TEMPLATE/design_system.yml

@@ -47,7 +47,7 @@ body:
       placeholder: |
         - [ ] Move shared behavior into the primitive
         - [ ] Remove duplicated local styling where appropriate
-        - [ ] Update docs/wiki if behavior or language changes
+        - [ ] Update docs if behavior or language changes
     validations:
       required: false
 

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -45,7 +45,7 @@ body:
       placeholder: |
         - [ ] Compare the main options
         - [ ] Check affected screens, commands, or settings
-        - [ ] Confirm docs/wiki impact
+        - [ ] Confirm docs impact
     validations:
       required: false
 
@@ -57,7 +57,7 @@ body:
       placeholder: |
         - [ ] Update the relevant app/core code
         - [ ] Add or update focused tests
-        - [ ] Update docs/wiki if behavior or language changes
+        - [ ] Update docs if behavior or language changes
     validations:
       required: false
 

.github/ISSUE_TEMPLATE/navigation_tooling.yml

@@ -47,7 +47,7 @@ body:
       placeholder: |
         - [ ] Update navigation, toolbar, panel, or measurement code
         - [ ] Add focused tests or smoke coverage where practical
-        - [ ] Update docs/wiki if behavior or terminology changes
+        - [ ] Update docs if behavior or terminology changes
     validations:
       required: false
 

.github/ISSUE_TEMPLATE/research_exploration.yml

@@ -38,7 +38,7 @@ body:
       placeholder: |
         - [ ] Post the recommendation and tradeoffs
         - [ ] Create or update follow-up implementation issues
-        - [ ] Update docs/wiki if policy or workflow changes
+        - [ ] Update docs if policy or workflow changes
     validations:
       required: false
 

.github/pull_request_template.md

@@ -22,24 +22,25 @@
 ## Validation
 
 - [ ] `git diff --check`
-- [ ] `./scripts/ci-validate.sh`
+- [ ] `./Scripts/check.sh repo`
 - [ ] `swift build`
 - [ ] `swift test`
-- [ ] UI/app changes smoke-tested with `./scripts/bundle.sh debug`
-- [ ] Release/script changes covered by `./scripts/test-release-scripts.sh` and relevant validators
+- [ ] UI/app changes smoke-tested with `./Scripts/package.sh app debug`
+- [ ] Release/script changes covered by `./Scripts/check.sh release` and relevant validators
 
 ## Release Notes And Docs
 
-- [ ] Added or updated a release/change note, or applied the `no-release-note` label for docs/meta/dependency-only maintenance
-- [ ] Updated `docs/wiki` for user-facing behavior or workflow changes, or this PR does not need docs
-- [ ] Synced `Sources/Contained/Resources/CHANGELOG.md` when `CHANGELOG.md` changed (`./scripts/sync-changelog-resource.sh --check` passes)
+- [ ] Added or updated a release/change note, or applied the `no-release-note` label for documentation, metadata, or dependency-only maintenance
+- [ ] Updated `docs` for user-facing behavior or workflow changes, or this PR does not need docs
+- [ ] Updated `Documentation/Wiki/File-Map.md` and `Documentation/Wiki/_Sidebar.md` when documentation/package docs should appear in the wiki
+- [ ] Synced `Sources/ContainedApp/Resources/CHANGELOG.md` when `CHANGELOG.md` changed (`./Scripts/package.sh app debug` then `./Scripts/check.sh repo` passes)
 
 ## Update Safety
 
-- [ ] Build numbers still come only from `scripts/version-info.sh`
+- [ ] Build numbers still come only from `Scripts/package.sh version`
 - [ ] Nightly can still receive promoted Beta/Stable appcast items
 - [ ] Generated appcast commits still use `[skip ci]` and do not trigger release loops
-- [ ] Bundle/appcast changes were validated with `scripts/validate-bundle.sh` and `scripts/validate-appcast.sh`
+- [ ] Bundle/appcast changes were validated with `Scripts/package.sh smoke` and `Scripts/appcast.sh validate`
 
 ## Notes For Reviewers
 

.github/workflows/beta.yml

@@ -15,13 +15,21 @@ on:
     # Docs/meta-only changes don't need a build. Changelog changes do, because the changelog is
     # bundled into the app and drives GitHub/Sparkle release notes.
     paths-ignore:
-      - 'docs/**'
+      - 'Documentation/**'
       - 'README.md'
+      - 'Packages/*/README.md'
+      - 'Packages/*/Sources/*/*.docc/**'
+      - 'Changes/**'
       - 'CODE_OF_CONDUCT.md'
-      - '.github/CONTRIBUTING.md'
+      - '.github/*.md'
+      - '.github/ISSUE_TEMPLATE/**'
       - '.github/assets/**'
+      - '.github/dependabot.yml'
+      - 'CODEOWNERS'
       - 'LICENSE'
       - 'NOTICE'
+      - 'SECURITY.md'
+      - 'SUPPORT.md'
       - '.gitignore'
       - 'appcast.xml'
   workflow_dispatch:
@@ -36,6 +44,7 @@ permissions:
 jobs:
   beta:
     runs-on: macos-26
+    timeout-minutes: 30
     env:
       SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
       GH_TOKEN: ${{ github.token }}
@@ -58,34 +67,35 @@ jobs:
         if: steps.guard.outputs.build == 'true'
         run: |
           set -euo pipefail
-          ./scripts/ci-validate.sh
-          ./scripts/test-release-scripts.sh
+          brew list ripgrep >/dev/null 2>&1 || brew install ripgrep
+          ./Scripts/check.sh repo
+          ./Scripts/check.sh release
           swift build -c release
           swift test
-          ./scripts/check-generated-clean.sh
+          ./Scripts/check.sh generated
 
       - name: Bundle (ad-hoc signed) + DMG
         if: steps.guard.outputs.build == 'true'
         run: |
           set -euo pipefail
           git fetch origin nightly:refs/remotes/origin/nightly
-          SHA=$(CHANNEL=beta ./scripts/version-info.sh sha)
-          BUILD=$(CHANNEL=beta BUILD_SOURCE_REF=origin/nightly SHA="${SHA}" ./scripts/version-info.sh build)
-          VERSION=$(CHANNEL=beta BUILD="${BUILD}" SHA="${SHA}" ./scripts/version-info.sh version)
+          SHA=$(CHANNEL=beta ./Scripts/package.sh version sha)
+          BUILD=$(CHANNEL=beta BUILD_SOURCE_REF=origin/nightly SHA="${SHA}" ./Scripts/package.sh version build)
+          VERSION=$(CHANNEL=beta BUILD="${BUILD}" SHA="${SHA}" ./Scripts/package.sh version version)
           export BUILD SHA VERSION
           {
-            echo "BASE_VERSION=$(./scripts/version-info.sh base)"
+            echo "BASE_VERSION=$(./Scripts/package.sh version base)"
             echo "BUILD=${BUILD}"
             echo "SHA=${SHA}"
             echo "VERSION=${VERSION}"
           } >> "$GITHUB_ENV"
-          CHANNEL=beta BUILD="${BUILD}" VERSION="${VERSION}" ./scripts/bundle.sh release
-          VERSION="${VERSION}" BUILD="${BUILD}" ./scripts/validate-bundle.sh Contained.app
-          ./scripts/check-generated-clean.sh
+          CHANNEL=beta BUILD="${BUILD}" VERSION="${VERSION}" ./Scripts/package.sh app release
+          VERSION="${VERSION}" BUILD="${BUILD}" ./Scripts/package.sh smoke Contained.app
+          ./Scripts/check.sh generated
           mkdir -p updates
           brew install create-dmg
-          ./scripts/make-dmg.sh beta Contained.app "updates/Contained-${VERSION}.dmg"
-          CHANNEL=beta VERSION_VALUE="${VERSION}" ./scripts/release-body.sh > updates/release-notes.md
+          ./Scripts/package.sh dmg beta Contained.app "updates/Contained-${VERSION}.dmg"
+          CHANNEL=beta VERSION_VALUE="${VERSION}" ./Scripts/notes.sh body > updates/release-notes.md
           {
             echo "Automated beta build @ ${SHA}."
             echo
@@ -119,8 +129,8 @@ jobs:
           [ -x "$BIN/generate_appcast" ] || BIN="$(dirname "$(find .build -type f -name generate_appcast | head -1)")"
           ED_KEY_FILE="$KEYFILE" \
             DOWNLOAD_PREFIX="https://github.com/tdeverx/contained-app/releases/download/v${VERSION}/" \
-            ./scripts/appcast.sh "$BIN" updates
-          CHANNEL=beta ./scripts/validate-appcast.sh appcast.xml
+            ./Scripts/appcast.sh generate "$BIN" updates
+          CHANNEL=beta ./Scripts/appcast.sh validate appcast.xml
           rm -f "$KEYFILE"
           git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -138,10 +148,10 @@ jobs:
           NIGHTLY_WORKTREE="$(mktemp -d)"
           rm -rf "$NIGHTLY_WORKTREE"
           git worktree add "$NIGHTLY_WORKTREE" origin/nightly
-          ./scripts/promote-appcast-to-nightly.sh "$PROMOTED_APPCAST" "$NIGHTLY_WORKTREE/appcast.xml"
+          ./Scripts/appcast.sh promote "$PROMOTED_APPCAST" "$NIGHTLY_WORKTREE/appcast.xml"
           (
             cd "$NIGHTLY_WORKTREE"
-            CHANNEL=nightly "$GITHUB_WORKSPACE/scripts/validate-appcast.sh" appcast.xml
+            CHANNEL=nightly "$GITHUB_WORKSPACE/Scripts/appcast.sh" validate appcast.xml
             git config user.name  "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
             git add appcast.xml
@@ -154,3 +164,18 @@ jobs:
           )
           git worktree remove "$NIGHTLY_WORKTREE" --force
           rm -f "$PROMOTED_APPCAST"
+
+      - name: Clear beta release-note accumulator
+        if: steps.guard.outputs.build == 'true'
+        run: |
+          set -euo pipefail
+          ./Scripts/notes.sh finalize beta
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Changes/Beta.md
+          if git diff --cached --quiet; then
+            echo "beta release notes already clear."
+          else
+            git commit -m "ci: clear beta notes (${VERSION}) [skip ci]"
+            git push origin HEAD:beta
+          fi

.github/workflows/codeql.yml

@@ -7,35 +7,49 @@ on:
   pull_request:
     branches: [main, nightly, beta, stable]
     paths-ignore:
-      - 'docs/**'
+      - 'Documentation/**'
       - 'README.md'
+      - 'Packages/*/README.md'
+      - 'Packages/*/Sources/*/*.docc/**'
       - 'CHANGELOG.md'
       - 'CODE_OF_CONDUCT.md'
+      - '.github/*.md'
       - '.github/**/*.md'
       - '.github/ISSUE_TEMPLATE/**'
       - '.github/assets/**'
+      - '.github/dependabot.yml'
+      - 'CODEOWNERS'
       - 'LICENSE'
       - 'NOTICE'
+      - 'SECURITY.md'
+      - 'SUPPORT.md'
       - '.gitignore'
-      - 'Sources/Contained/Resources/CHANGELOG.md'
+      - 'Sources/ContainedApp/Resources/CHANGELOG.md'
       - 'appcast.xml'
-      - 'changes/**'
+      - 'Changes/**'
   push:
     branches: [nightly, beta, stable]
     paths-ignore:
-      - 'docs/**'
+      - 'Documentation/**'
       - 'README.md'
+      - 'Packages/*/README.md'
+      - 'Packages/*/Sources/*/*.docc/**'
       - 'CHANGELOG.md'
       - 'CODE_OF_CONDUCT.md'
+      - '.github/*.md'
       - '.github/**/*.md'
       - '.github/ISSUE_TEMPLATE/**'
       - '.github/assets/**'
+      - '.github/dependabot.yml'
+      - 'CODEOWNERS'
       - 'LICENSE'
       - 'NOTICE'
+      - 'SECURITY.md'
+      - 'SUPPORT.md'
       - '.gitignore'
-      - 'Sources/Contained/Resources/CHANGELOG.md'
+      - 'Sources/ContainedApp/Resources/CHANGELOG.md'
       - 'appcast.xml'
-      - 'changes/**'
+      - 'Changes/**'
   schedule:
     - cron: '37 4 * * 1'
   workflow_dispatch: