feat: add provenance-backed repository autocomplete

.github/workflows/autocomplete-check.yml

@@ -0,0 +1,105 @@
+name: Repository autocomplete
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/autocomplete-check.yml"
+      - "scripts/autocomplete_*.py"
+      - "scripts/check_autocomplete.py"
+      - "tests/test_autocomplete_*"
+      - "landgrab/autocomplete/**"
+      - "landgrab/hq.html"
+      - "landgrab/README.md"
+      - "AGENTS.md"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/autocomplete-check.yml"
+      - "scripts/autocomplete_*.py"
+      - "scripts/check_autocomplete.py"
+      - "tests/test_autocomplete_*"
+      - "landgrab/autocomplete/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: autocomplete-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Obtain the pinned public RAPP reference
+        shell: bash
+        run: |
+          set -euo pipefail
+          reference="$RUNNER_TEMP/autocomplete-rapp-reference"
+          git init --quiet "$reference"
+          git -C "$reference" remote add origin https://github.com/kody-w/rapp-1.git
+          git -C "$reference" fetch --quiet --depth=1 origin eb50008011447f5e69372ac22a1755f0978d15ed
+          git -C "$reference" checkout --quiet --detach FETCH_HEAD
+          test "$(git -C "$reference" rev-parse HEAD)" = eb50008011447f5e69372ac22a1755f0978d15ed
+          echo "RAPP_REFERENCE=$reference" >> "$GITHUB_ENV"
+
+      - name: Qualify real source, parallel frames, and browser behavior
+        shell: bash
+        run: |
+          set -euo pipefail
+          chrome="$(command -v google-chrome || command -v chromium || command -v chromium-browser || true)"
+          if [ -z "$chrome" ]; then
+            echo "::error::An installed Chromium browser is required; the browser gate cannot be skipped."
+            exit 1
+          fi
+          profile="$(mktemp -d "$RUNNER_TEMP/autocomplete-chrome.XXXXXX")"
+          browser_pid=""
+          python3 -m http.server 18766 --bind 127.0.0.1 > "$RUNNER_TEMP/autocomplete-http.log" 2>&1 &
+          server_pid=$!
+          cleanup() {
+            kill "$server_pid" 2>/dev/null || true
+            if [ -n "$browser_pid" ]; then
+              kill "$browser_pid" 2>/dev/null || true
+            fi
+          }
+          trap cleanup EXIT
+          "$chrome" --headless=new --user-data-dir="$profile" \
+            --remote-debugging-port=0 --remote-debugging-address=127.0.0.1 \
+            --no-first-run --no-default-browser-check --disable-background-networking \
+            --disable-extensions --log-level=3 about:blank \
+            > "$RUNNER_TEMP/autocomplete-chrome.log" 2>&1 &
+          browser_pid=$!
+          ready=0
+          for attempt in $(seq 1 100); do
+            if [ -s "$profile/DevToolsActivePort" ] && \
+              curl --fail --silent http://127.0.0.1:18766/landgrab/autocomplete/index.html > /dev/null; then
+              ready=1
+              break
+            fi
+            sleep 0.2
+          done
+          if [ "$ready" != 1 ]; then
+            tail -n 40 "$RUNNER_TEMP/autocomplete-chrome.log"
+            echo "::error::The isolated browser and static preview did not become ready."
+            exit 1
+          fi
+          port="$(head -n 1 "$profile/DevToolsActivePort")"
+          curl --fail --silent "http://127.0.0.1:$port/json/version" > /dev/null
+          python3 scripts/check_autocomplete.py \
+            --rapp-dir "$RAPP_REFERENCE" \
+            --cdp "http://127.0.0.1:$port" \
+            --url http://127.0.0.1:18766/landgrab/autocomplete/index.html

.github/workflows/capability-loop.yml

@@ -0,0 +1,57 @@
+name: Evergreen capability loop
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/capability-loop.yml"
+      - "scripts/capability_*.py"
+      - "scripts/check_capability_loop.py"
+      - "tests/test_capability_*.py"
+      - "landgrab/autocomplete/capabilities/**"
+      - "CAPABILITIES.md"
+      - "AGENTS.md"
+  push:
+    branches: [main]
+    paths:
+      - "scripts/capability_*.py"
+      - "scripts/check_capability_loop.py"
+      - "tests/test_capability_*.py"
+      - "landgrab/autocomplete/capabilities/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: capability-loop-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualify-and-reuse:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Obtain the pinned reference and independent public source
+        shell: bash
+        run: |
+          set -euo pipefail
+          reference="$RUNNER_TEMP/capability-rapp-reference"
+          git init --quiet "$reference"
+          git -C "$reference" remote add origin https://github.com/kody-w/rapp-1.git
+          git -C "$reference" fetch --quiet --depth=1 origin eb50008011447f5e69372ac22a1755f0978d15ed
+          git -C "$reference" checkout --quiet --detach FETCH_HEAD
+          source="../openrappter-reuse-snapshot"
+          git init --quiet "$source"
+          git -C "$source" remote add origin https://github.com/kody-w/openrappter.git
+          git -C "$source" fetch --quiet --depth=1 origin f3c64386d69a6c54689e774ef777afbd38961b19
+          git -C "$source" checkout --quiet --detach FETCH_HEAD
+          git fetch --quiet --no-tags origin b60ba4eefb5ab99dccb5b44dc9080f35dc33ce33
+          echo "RAPP_REFERENCE_DIR=$reference" >> "$GITHUB_ENV"
+      - name: Qualify the registry, packages, and bounded reuse loop
+        run: python3 scripts/check_capability_loop.py --root . --rapp-dir "$RAPP_REFERENCE_DIR" --exercise

AGENTS.md

@@ -23,4 +23,19 @@ Register the dependency-free MCP server, then use `search_tools` / `open_tool` /
 ## Browse (humans)
 Live dashboard → https://kody-w.github.io/localFirstTools/landgrab/hq.html
 
+## Improve or expand the repository
+Before creating another capability, read [`CAPABILITIES.md`](CAPABILITIES.md)
+and search the qualified capability registry. Reuse exact approved revisions,
+inspect failure cases, and make a bounded policy-admitted plan. A future-model
+event should requalify existing assets before generating replacements.
+Never treat a requested model label, an unexecuted plan, or a repeated use in
+the same repository as independent success.
+
+Use the [repository-autocomplete operator](landgrab/autocomplete/operator.html)
+for a bounded, source-grounded improvement cycle. Its [workbench](landgrab/autocomplete/index.html)
+exposes canonical source passports, candidate tasks, and RAPP/1 implementation
+records. Preserve source attribution and distinguish planned, implemented,
+checked, and publicly published work. Do not launch an unbounded job or infer
+publishing permission from a generated task.
+
 _Owned by @kody-w · MIT · zero-server · offline-first._

CAPABILITIES.md

@@ -0,0 +1,21 @@
+# Evergreen capabilities
+
+The canonical operating procedure is
+[`landgrab/autocomplete/capabilities/operator.html`](landgrab/autocomplete/capabilities/operator.html),
+bound by its adjacent `operator.manifest.json`. This file is a navigation
+adapter, not a second behavioral authority.
+
+Start with the capability registry, not a new duplicate implementation:
+
+```bash
+python3 scripts/capability_registry.py search --registry landgrab/autocomplete/capabilities/registry.json --query "restore source"
+```
+
+The registry distinguishes built, proven and independently reused assets.
+The qualification packager produces and replays real source capsules.
+The scheduler executes only policy-admitted, bounded jobs and preserves
+completed/failed/recovery-required outcomes.
+
+Requested model metadata is not evidence of model execution. The coding
+host supplies model reasoning; the deterministic tools do not quietly launch
+or spend through a provider.

landgrab/README.md

@@ -7,6 +7,19 @@ invoke, and cite. Everything is **static + zero-server** (rides `raw.githubuserc
 
 **▶ Start at the [AI Landgrab HQ](https://kody-w.github.io/localFirstTools/landgrab/hq.html).**
 
+## Repository autocomplete and implementation provenance
+
+The [autocomplete workbench](autocomplete/index.html) builds on this layer:
+canonical discovery instead of counting redirects as inventions, bounded
+source-grounded improvement tasks, portable source passports, and independently
+verifiable implementation records carried by RAPP/1 frames.
+
+The [operator guide](autocomplete/operator.html) documents the repeatable AI
+coding loop, parallel worktree/stream ownership, and publication gates. The
+browser is a local-first inspection surface, not an unattended model service.
+Public records identify specific implementations and their source ancestry;
+they do not establish first invention or exclusive ownership.
+
 ## The 10 flag-plants → what ships them
 | # | Landgrab move | Artifact |
 |---|---|---|

landgrab/autocomplete/capabilities/failures.json

@@ -0,0 +1,72 @@
+{
+  "schema": "localfirst-failure-genome/v1",
+  "cases": [
+    {
+      "id": "replay-argument-contract-drift",
+      "status": "fixed",
+      "observed_stage": "scheduler validation after successful source qualification",
+      "symptom": "Both real source projects qualified, but the scheduler rejected the packager's standalone --replay and --allow-checks flags.",
+      "cause": "The scheduler treated every verification argument as a flag/value pair; its fixture omitted the real boolean flags.",
+      "correction": "Bind the exact canonical verifier argv, including source checkout, report, capsule, replay and explicit process permission.",
+      "regression": "tests/test_capability_scheduler.py: test_invalid_reports_never_reach_replay",
+      "acceptance": [
+        "The real packager's replay command is admitted.",
+        "Missing --replay or --allow-checks is refused.",
+        "The same real two-project plan completes after the corrected contract."
+      ],
+      "lesson": "Producer and consumer fixtures must share the actual executable contract; component-level green results are not integrated compatibility."
+    },
+    {
+      "id": "public-evidence-fixture-compatibility",
+      "status": "fixed",
+      "observed_stage": "RAPP publication after successful qualification",
+      "symptom": "The public-artifact guard refused a test source file containing a synthetic secret-shaped literal.",
+      "cause": "The evaluator's fixture was safe as a test input but incompatible with preserving the evaluator itself as a public source artifact.",
+      "correction": "Keep the guard unchanged; generate clearly synthetic refusal input at runtime and repin the changed evaluator revision before retrying.",
+      "regression": "tests/test_capability_package.py: test_traversal_private_binary_and_colliding_paths_are_refused",
+      "acceptance": [
+        "Secret-shaped inputs remain refused.",
+        "All declared public capability and evaluator artifacts can be preserved without a secret exception.",
+        "The changed manifest and explicit policy use a new revision; exhausted attempts are not erased."
+      ],
+      "lesson": "A durable capability includes usable evaluation assets; qualification must extend through the actual evidence-publication boundary."
+    },
+    {
+      "id": "help-is-not-a-qualification",
+      "status": "fixed",
+      "symptom": "A verifier command with --help can exit zero without exercising the qualification.",
+      "correction": "All producers and consumers share one exact replay contract that rejects help, extra or duplicate options, option-like argument values, and script entrypoints beginning with a dash.",
+      "regression": "tests/test_capability_registry.py: test_help_only_replay_cannot_promote_even_when_its_process_exits_zero",
+      "lesson": "A successful process exit must be tied to the intended operation, not merely the expected executable name."
+    },
+    {
+      "id": "dependency-evidence-closure",
+      "status": "fixed",
+      "symptom": "A primary capability can complete while its dependency manifests and helper bytes are absent from the recorded evidence.",
+      "correction": "Carry, revalidate and attest the complete transitive dependency closure; enforce recorder limits on the complete set.",
+      "regression": "tests/test_capability_scheduler.py: test_dependency_manifests_and_artifacts_are_recorded_with_the_job",
+      "lesson": "Reuse edges must bind executable dependencies through qualification and publication, not stop at planning."
+    },
+    {
+      "id": "exhausted-work-must-not-starve-new-work",
+      "status": "fixed",
+      "symptom": "A retained plan repeatedly selects an exhausted or interrupted job before an eligible job and spends its whole execution budget refusing the first item.",
+      "correction": "Determine eligibility before allocating execution slots; report blocked, busy and recovery-required work without consuming the run budget.",
+      "regression": "tests/test_capability_scheduler.py: test_exhausted_job_does_not_starve_later_eligible_work",
+      "lesson": "Failure retention and progress are compatible only when refusal states cannot monopolize the scheduler."
+    },
+    {
+      "id": "qualification-must-use-the-pinned-source-not-the-current-checkout",
+      "status": "fixed",
+      "symptom": "The source capsule was correctly built from its selected Git commit, but qualification compared it to newer checkout files and failed after the repository evolved.",
+      "correction": "Compare source content with the selected immutable Git objects. Continue checking executing capability artifacts against current manifest pins and restored output against capsule bytes.",
+      "regression": "tests/test_capability_package.py: test_qualification_replays_the_pinned_commit_not_current_checkout_files",
+      "lesson": "A replayable artifact must not silently depend on unrelated current working-tree contents."
+    }
+  ],
+  "limitations": [
+    "These are observed engineering failures, not claims about unrelated applications.",
+    "No sensitive fixture value is reproduced here.",
+    "A failure remains identified until its end-to-end acceptance has completed."
+  ]
+}

landgrab/autocomplete/capabilities/history/2c7c79103527d0d1dda474ce616cab7f57349caceab85af507a9421e336e85a3.json

@@ -0,0 +1,83 @@
+{
+  "schema": "localfirst-capability/v1",
+  "id": "source-capsule",
+  "version": "1.0.0",
+  "title": "Committed source capsule",
+  "job": "Transfer and safely restore an explicitly selected public UTF-8 source artifact from an exact Git commit, retaining fingerprints, modes and qualification evidence.",
+  "entrypoint": "scripts/capability_package.py",
+  "artifacts": [
+    {
+      "path": "scripts/capability_package.py",
+      "sha256": "813bfe388e72a7b7019d609da4ee99a73719e3f74298420e0e391d64c6f75e42",
+      "bytes": 21771
+    },
+    {
+      "path": "scripts/capability_contracts.py",
+      "sha256": "06dac1f0e3d9e65ab801d76e42725e3877232f5a0c88a6f738fb1f76b7304d44",
+      "bytes": 7540
+    },
+    {
+      "path": "scripts/autocomplete_catalog.py",
+      "sha256": "e85d6b128a06536b9b42a532fee37a44d1eaf0184f59a9ad96bd1b6768ee8c6d",
+      "bytes": 37611
+    },
+    {
+      "path": "scripts/autocomplete_frames.py",
+      "sha256": "c2b0dec0f5e0801f2258a998c0b457e6ba10355491a2aae53316da41cd0c794c",
+      "bytes": 42846
+    },
+    {
+      "path": "tests/test_capability_package.py",
+      "sha256": "d630e87ef6d4d6420390b79cab6c48e3af981f1dd37da39c4b4c9e00e2cdba18",
+      "bytes": 22209
+    },
+    {
+      "path": "tests/test_capability_contracts.py",
+      "sha256": "629179245081a01520633636ca0211f8dab349cb56f3e89eb9a2b2cd03c82070",
+      "bytes": 5020
+    }
+  ],
+  "contract": {
+    "inputs": {
+      "type": "object",
+      "required": ["repository", "commit", "paths"],
+      "properties": {
+        "repository": {"type": "string", "description": "Public GitHub owner/name."},
+        "commit": {"type": "string", "description": "Exact available Git commit, not a mutable branch label."},
+        "paths": {"type": "array", "items": {"type": "string"}, "minItems": 1, "maxItems": 32}
+      }
+    },
+    "outputs": {
+      "type": "object",
+      "required": ["capsule", "qualification"],
+      "properties": {
+        "capsule": {"type": "object", "description": "Deterministic localfirst-source-capsule/v1 document with exact UTF-8 file bytes and modes."},
+        "qualification": {"type": "object", "description": "Source comparison, fresh restore and actual declared-check results, bound to a replay command."}
+      }
+    },
+    "permissions": ["repository.read", "artifact.write", "process.execute"],
+    "network": "none"
+  },
+  "checks": [
+    {
+      "id": "capsule-behavior",
+      "argv": ["python3", "-B", "-m", "unittest", "discover", "-s", "tests", "-p", "test_capability_package.py", "-q"],
+      "timeout_seconds": 90
+    },
+    {
+      "id": "capability-contract",
+      "argv": ["python3", "-B", "-m", "unittest", "discover", "-s", "tests", "-p", "test_capability_contracts.py", "-q"],
+      "timeout_seconds": 30
+    }
+  ],
+  "failure_cases": [
+    "Tampered capsule bytes, sizes or hashes are refused.",
+    "Traversal, symlink, private-path and non-UTF-8 source inputs are refused.",
+    "An occupied restoration destination is not overlaid.",
+    "Changed implementation bytes invalidate the manifest revision.",
+    "Altered qualification gates or replay-command bindings are refused.",
+    "Failed real commands cannot produce a passing qualification."
+  ],
+  "reuses": [],
+  "visibility": "public"
+}