Clarifies that macOS is the only v5 GA desktop release target and keeps Linux/Windows artifacts labeled as preview-only validation outputs. Closes#645.
## Summary
- adds the v5 dual-storage parity fixture and focused parity test suite
- covers rich task metadata, archive lifecycle, comments/chat history, settings/templates, prompt usage, telemetry/activity/status history, and a workflow run
- adds an explicit CI parity step for file and SQLite storage drift
- preserves newer file-mode task metadata on reload and stabilizes SQLite chat ordering
- hardens workflow parity polling for asynchronous run writes
## Verification
- GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests
- Local focused parity test, server typecheck, lint budget, build, and audit high gate
## Summary
- adds a v5 permission coverage manifest with classifications, required permissions, denial reasons, and review justifications across REST, WebSocket, CLI, MCP, workflow, transition hook, command palette, and background job surfaces
- adds a Node-based coverage checker that fails when tracked surfaces are missing from the manifest or when REST route prefixes drift from the shared permission map
- wires the checker into CI and documents the manifest gate in the security guide
Closes#420.
## Verification
- `node scripts/check-permission-coverage.mjs`
- `./node_modules/.bin/prettier --check package.json .github/workflows/ci.yml scripts/check-permission-coverage.mjs docs/security/permission-coverage.json docs/security.md`
- `git diff --check`
- `pnpm lint:budget`
- `pnpm build`
- `pnpm audit --prod --audit-level=high` (passes high gate; 3 existing moderate findings)
- GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests
Add release validation and scheduled QA workflows.
Harden webhook URL handling, API helper edge cases, and runtime version reporting.
Split heavy web bundles, centralize view metadata, and stabilize full-suite tests.
- ESLint 9 + ajv has incompatibility with Node 22 causing TypeError
- minimatch <10.2.1 ReDoS vulnerability via exceljs dependencies
- Both fixes minimal and targeted to get CI green
- Add 'Build shared' step to Lint & Type Check job in CI workflow
- Add explicit type annotations to ~50 parameters across server + CLI
- Fix docker-paths test to properly mock filesystem operations
- Verified: clean install → shared build → lint/typecheck/test/build all passing
