Close out the Panely v0.7.0 ship run

docs/goal.md

@@ -1,12 +1,12 @@
 # Goal
 
-**Status:** active
+**Status:** complete
 **Created:** 2026-07-15
-**Updated:** 2026-07-15
+**Updated:** 2026-07-16
 **Repo:** repository root
 **Branch:** `codex/grok-frontier-providers`
 **Validation gate:** `npm run verify`
-**Active plan:** `specs/panely-four-frontier-provider-release.html`
+**Completed plan:** `specs/panely-four-frontier-provider-release.html`
 
 ## Objective
 
@@ -22,4 +22,4 @@ Bring Panely to feature and release-discipline parity with the advisory-board v1
 
 ## Current Validation Gate
 
-The run is complete only after focused tests, `npm run verify`, adversarial final-diff review, green GitHub checks, merged PR, annotated tag, verified GitHub Release, repository-setting verification, and safe worktree/branch cleanup.
+Completed on 2026-07-16 with green local and GitHub gates, merged PRs #3 and #4, annotated `v0.7.0`, two successful release runs (create and update), verified repository protection/metadata, and safe checkout cleanup.

docs/handoff.md

@@ -0,0 +1,41 @@
+# Panely handoff
+
+## START HERE
+
+Panely `v0.7.0` is released. Start from clean `main` and read `docs/goal.md`, `docs/plans/grok-frontier-release.md`, and the live evidence view at `specs/panely-four-frontier-provider-release.html`.
+
+## STATE
+
+- `main` is protected and requires the strict `Verify` check.
+- PR #3 shipped four floating frontier selectors and Grok integration.
+- PR #4 fixed annotated-tag validation after GitHub checkout dereferencing.
+- Annotated `v0.7.0` targets merge commit `6ecfa5b`; the GitHub Release create and update paths both succeeded.
+- Draft PR #1 and `codex/durable-workflow-kit` remain open and untouched.
+
+## DONE
+
+- Claude `opus`, Codex `auto`, Gemini `pro`, and Grok `grok-build` float at runtime; explicit choices remain pinned.
+- Requested and CLI-reported model identities are stored separately.
+- Grok execution, health, disclosure, mocks, tests, docs, CI, release automation, repository settings, and cleanup are complete.
+
+## NEXT
+
+- Treat `CHANGELOG.md` `[Unreleased]` as the source for the next milestone.
+- Review draft PR #1 independently; do not infer that this release approved or superseded it.
+- Upgrade local Codex or authenticate Gemini if their current doctor failures need to be cleared on this machine.
+
+## KEY FILES
+
+- `src/lib/ai/providers.ts`
+- `src/lib/ai/router.ts`
+- `src/lib/ai/model-health.ts`
+- `RELEASING.md`
+- `.github/workflows/ci.yml`
+- `.github/workflows/release.yml`
+
+## GOTCHAS / DON'T-REPEAT
+
+- The official Grok CLI currently rejects `grok-build` as a literal model ID; Panely preserves it as the semantic selector and omits `--model` so the CLI resolves its maintained default.
+- Keep Grok's temporary-home isolation; otherwise user MCP/plugin configuration is inherited.
+- GitHub checkout can dereference an annotated tag locally. Keep the explicit remote tag-ref fetch before tag-object validation.
+- Do not move a published release tag. Use the idempotent manual release rerun for safe recovery.

docs/plans/grok-frontier-release.md

@@ -1,6 +1,6 @@
 # Panely Four-Frontier Provider Release
 
-**Status:** implementation verified; final review and publication in progress
+**Status:** complete and released
 **Created:** 2026-07-15
 **Live status and evidence:** `specs/panely-four-frontier-provider-release.html`
 **Candidate version:** `v0.7.0`

specs/panely-four-frontier-provider-release.html

@@ -18,11 +18,11 @@ <h1>Panely Four-Frontier Provider Release</h1>
   <details class="meta" open><summary>Metadata</summary><dl>
     <dt>created</dt><dd>2026-07-15T23:15:00-07:00</dd>
     <dt>modified</dt><dd>2026-07-15T23:15:00-07:00, 2026-07-15T23:24:00-07:00, 2026-07-15T23:47:00-07:00</dd>
-    <dt>commits</dt><dd>pending</dd>
+    <dt>commits</dt><dd><code>43b4a47</code> implementation; <code>6ecfa5b</code> release merge; <code>dfba4cd</code> tag-validation hotfix; <code>ecb79bb</code> current main</dd>
     <dt>agent name</dt><dd>Codex / root</dd>
     <dt>session id</dt><dd>019f6988-d956-7553-8f7b-95c12ac68b25</dd>
     <dt>back refs</dt><dd>advisory-board v1.16.0, Panely v0.6.0, PR #1</dd>
-    <dt>forward refs</dt><dd>Panely v0.7.0 candidate, release PR pending</dd>
+    <dt>forward refs</dt><dd>Panely v0.7.0 released; PRs #3 and #4 merged</dd>
   </dl></details>
 </header>
 <figure><img src="panely-four-frontier-provider-release/four-frontiers-hero.png" alt="Four frontier provider terminals converge into a verified Panely release"><figcaption>Four independently maintained frontier selectors, one safe local router, one verifiable release.</figcaption></figure>
@@ -80,22 +80,22 @@ <h3>Existing Files</h3><ul>
 <li><code class="status">[x]</code> Update README/provider docs with selector vs pin semantics, Grok requirements, egress/privacy, health troubleshooting, and provenance meaning.</li>
 <li><code class="status">[x]</code> Validate repository description, topics, homepage, default branch, and automatic merged-branch cleanup proposal.</li>
 </ul><h4>Testing Strategy</h4><ul class="checklist"><li><code class="status">[x]</code> <code>npm run verify</code> — complete project gate.</li><li><code class="status">[x]</code> release-policy tests — missing/duplicate changelog refusal, annotated tags, and create/update decisions.</li><li><code class="status">[x]</code> <code>git diff --check</code> — patch hygiene.</li></ul><div class="loop">🔁 Changelog lands before tag; no tag is created before the release commit is merged and green.</div></div>
-<div class="phase"><h3><code class="status">[wip]</code> Phase 5: Adversarial Review, PR, Merge, Release, and Cleanup</h3><p>Publish only the reviewed staged diff, then safely reconcile repository topology.</p><ul class="checklist">
+<div class="phase"><h3><code class="status">[x]</code> Phase 5: Adversarial Review, PR, Merge, Release, and Cleanup</h3><p>Publish only the reviewed staged diff, then safely reconcile repository topology.</p><ul class="checklist">
 <li><code class="status">[x]</code> Run independent final review lenses and a skeptic pass; fix all surviving blockers and rerun affected gates.</li>
-<li><code class="status">[]</code> Stage intended files only, commit with review evidence, push, and open a PR.</li>
-<li><code class="status">[]</code> Wait for required checks, inspect failures, merge only when green, and verify the exact merge commit.</li>
-<li><code class="status">[]</code> This first PR is manually gated because protection does not yet exist. After merge, apply protection using the actual passing CI check name, auto-delete merged branches, and accurate metadata; re-read settings as proof.</li>
-<li><code class="status">[]</code> Create/push annotated <code>v0.7.0</code>, wait for release automation, verify notes/tag target/idempotent rerun behavior.</li>
-<li><code class="status">[]</code> Record before/after inventories of repositories, remotes, branches, worktrees, and directories. Prove and remove only the empty nested <code>Panely/Panely</code> directory below the primary checkout.</li>
-<li><code class="status">[]</code> Preserve draft PR #1 remotely. Move the three original untracked docs to a checksummed sibling preservation directory, switch the primary checkout to <code>main</code>, fast-forward to the verified release commit, then remove only the merged temporary worktree/local release branch. Do not delete the remote PR #1 branch.</li>
+<li><code class="status">[x]</code> Stage intended files only, commit with review evidence, push, and open a PR.</li>
+<li><code class="status">[x]</code> Wait for required checks, inspect failures, merge only when green, and verify the exact merge commit.</li>
+<li><code class="status">[x]</code> This first PR is manually gated because protection does not yet exist. After merge, apply protection using the actual passing CI check name, auto-delete merged branches, and accurate metadata; re-read settings as proof.</li>
+<li><code class="status">[x]</code> Create/push annotated <code>v0.7.0</code>, wait for release automation, verify notes/tag target/idempotent rerun behavior.</li>
+<li><code class="status">[x]</code> Record before/after inventories of repositories, remotes, branches, worktrees, and directories. Prove and remove only the empty nested <code>Panely/Panely</code> directory below the primary checkout.</li>
+<li><code class="status">[x]</code> Preserve draft PR #1 remotely. Move the three original untracked docs to a checksummed sibling preservation directory, switch the primary checkout to <code>main</code>, fast-forward to the verified release commit, then remove only the merged temporary worktree/local release branch. Do not delete the remote PR #1 branch.</li>
 </ul><div class="loop">🔁 Completion requires verified GitHub state, not only local success.</div></div>
 </section>
 <section id="validation"><h2>Global Validation Commands</h2><ul class="checklist">
 <li><code class="status">[x]</code> <code>npm run verify</code> — lint, tests, production build, typecheck, and publish safety.</li>
 <li><code class="status">[x]</code> <code>git diff --check</code> — whitespace and conflict-marker hygiene.</li>
-<li><code class="status">[]</code> <code>gh pr checks &lt;PR&gt; --watch</code> — GitHub CI evidence.</li>
-<li><code class="status">[]</code> <code>git cat-file -t v0.7.0</code> — annotated tag object.</li>
-<li><code class="status">[]</code> <code>gh release view v0.7.0</code> — generated release evidence.</li>
+<li><code class="status">[x]</code> <code>gh pr checks &lt;PR&gt; --watch</code> — GitHub CI evidence.</li>
+<li><code class="status">[x]</code> <code>git cat-file -t v0.7.0</code> — annotated tag object.</li>
+<li><code class="status">[x]</code> <code>gh release view v0.7.0</code> — generated release evidence.</li>
 </ul><div class="loop">🔁 <strong>The plan is incomplete until every applicable box is checked or explicitly marked [f] with a safe caveat.</strong></div></section>
 <section id="questionables"><h2>Questionables</h2>
 <details><summary>Why not pass <code>--model grok-build</code>?</summary><p>The authenticated official CLI 0.2.101 reports <code>grok-4.5</code> as its maintained default but rejects <code>grok-build</code> as a literal model ID. Panely will preserve <code>grok-build</code> as the requested selector, omit the literal flag for the floating default, and record the CLI-reported concrete model. Exact overrides continue to pass <code>--model</code>.</p></details>
@@ -109,5 +109,5 @@ <h3>Existing Files</h3><ul>
 <tr><td>xAI / Grok</td><td><code>grok-frontier</code> → <code>grok-build</code></td><td>Omit invalid literal model ID; isolate user config and use official CLI maintained default with read-only/plan controls.</td><td>Future exact Grok entries pass <code>--model</code>.</td></tr>
 </tbody></table><p>Provenance contract: <code>requestedModel</code> is always the user's selector/pin; <code>observedModel</code> exists only when a CLI independently reports a concrete model. Absence is rendered as “not reported,” never silently filled from configuration.</p></section>
 <section id="ui-evidence"><h2>UI Evidence</h2><p>The settings surface presents all four official CLI providers, floating selectors, pins, authentication, and probe failures without treating binary presence as readiness. The current machine evidence intentionally includes healthy, unauthenticated, upgrade-required, and transient provider-runtime states.</p><figure><img src="panely-four-frontier-provider-release/model-settings-desktop.png" alt="Desktop Panely model settings showing four frontier providers and readiness states"><figcaption>Desktop verification at 1440 × 1000.</figcaption></figure><figure><img src="panely-four-frontier-provider-release/model-settings-mobile.png" alt="Mobile Panely model settings showing responsive provider cards"><figcaption>Mobile verification at 390 × 844.</figcaption></figure></section>
-<section id="amendments"><h2>Amendments</h2><details><summary>2026-07-15T23:24:00-07:00 — First adversarial review blockers incorporated</summary><p>Expanded end-to-end provenance propagation; added stable ID compatibility and invalid-override policy; added proven ephemeral-HOME Grok isolation and broader failure sanitization; generalized readiness/UX across all four providers with screenshot evidence; and made repository/release cleanup concrete, changelog-required, and non-destructive to PR #1.</p></details><details><summary>2026-07-15T23:27:00-07:00 — Plan approved</summary><p>The independent second pass found no surviving blocking findings. Phase 1 is complete and provider implementation has started.</p></details><details><summary>2026-07-15T23:47:00-07:00 — Implementation gate passed</summary><p>All 106 project tests, production build, typecheck, lint, publish-safety scan, six release-policy tests, and diff hygiene passed. Desktop and mobile settings evidence is embedded.</p></details><details open><summary>2026-07-16T00:02:00-07:00 — Final review approved</summary><p>The independent final review found and verified fixes for active pinned-model defaults and unsafe manual release-input interpolation. A second consumer sweep found the remaining deep-dive and opening-message defaults; those were centralized too. The final skeptic pass found no surviving blockers.</p></details></section>
+<section id="amendments"><h2>Amendments</h2><details><summary>2026-07-15T23:24:00-07:00 — First adversarial review blockers incorporated</summary><p>Expanded end-to-end provenance propagation; added stable ID compatibility and invalid-override policy; added proven ephemeral-HOME Grok isolation and broader failure sanitization; generalized readiness/UX across all four providers with screenshot evidence; and made repository/release cleanup concrete, changelog-required, and non-destructive to PR #1.</p></details><details><summary>2026-07-15T23:27:00-07:00 — Plan approved</summary><p>The independent second pass found no surviving blocking findings. Phase 1 is complete and provider implementation has started.</p></details><details><summary>2026-07-15T23:47:00-07:00 — Implementation gate passed</summary><p>All 106 project tests, production build, typecheck, lint, publish-safety scan, six release-policy tests, and diff hygiene passed. Desktop and mobile settings evidence is embedded.</p></details><details><summary>2026-07-16T00:02:00-07:00 — Final review approved</summary><p>The independent final review found and verified fixes for active pinned-model defaults and unsafe manual release-input interpolation. A second consumer sweep found the remaining deep-dive and opening-message defaults; those were centralized too. The final skeptic pass found no surviving blockers.</p></details><details open><summary>2026-07-16T00:08:00-07:00 — Released and closed out</summary><p>PR #3 and the tag-validation hotfix PR #4 merged with green checks. The remote annotated <code>v0.7.0</code> tag targets <code>6ecfa5b</code>. The changelog-driven GitHub Release was created successfully and a second workflow dispatch updated it successfully. Main is protected and green; unrelated PR #1 work was preserved with checksums; only merged/empty temporary structures were removed.</p></details></section>
 </main></body></html>