Release 1.0.1: Nuru/DevCli pins, trusted-publishing probe, and audit-clean

.github/workflows/workflow.yml

@@ -22,6 +22,14 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      mode:
+        description: 'merge = normal CI (default). probe = trusted-publishing check only (OIDC login, no build, no publish).'
+        type: choice
+        options:
+          - merge
+          - probe
+        default: merge
 
 jobs:
   ci:
@@ -42,7 +50,7 @@ jobs:
           dotnet-version: '10.0.x'
 
       - name: NuGet login (OIDC Trusted Publishing)
-        if: github.event_name == 'release'
+        if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'probe')
         id: nuget-login
         uses: nuget/login@v1
         with:
@@ -63,7 +71,12 @@ jobs:
           owner: TimeWarpEngineering
           repositories: timewarp-software
 
+      - name: Trusted publishing probe result
+        if: github.event_name == 'workflow_dispatch' && inputs.mode == 'probe'
+        run: echo "Trusted publishing OK — OIDC exchange succeeded for this repo + workflow.yml."
+
       - name: Run CI Pipeline
+        if: github.event_name != 'workflow_dispatch' || inputs.mode != 'probe'
         env:
           GH_TOKEN: ${{ steps.rebuild-token.outputs.token }}
         run: |

.memsearch/memory/2026-07-02.md

@@ -80,3 +80,13 @@
 - Claude Code noted that uncommitted changes remain across five worktrees: terminal, nuru, amuru, ganda, and architecture.
 - Two open offers were mentioned: applying an editorconfig typo fix across seven remaining repositories, and repairing the amuru repository's pre-existing broken dev build.
 
+### 23:58
+<!-- session:179c59aa-cc0e-4094-99f1-0692f501682b turn:cddb4fc9-fba2-4e12-9406-5594d4d1c364 transcript:/home/steve/worktrees/github.com/TimeWarpEngineering/timewarp-flow/master/claude/projects/-home-steve-worktrees-github-com-TimeWarpEngineering-timewarp-terminal-dev/179c59aa-cc0e-4094-99f1-0692f501682b.jsonl -->
+- User requested running `ganda nuget outdated --update --force`
+- TimeWarp.Builder was identified as the only outdated package and updated from 1.0.0-beta.2 to 1.0.0-beta.3
+- Build and test verification passed with 0 errors and 33/33 tests passing
+- Claude Code consulted the repository's git conventions from `/home/steve/worktrees/github.com/TimeWarpEngineering/timewarp-flow/master/claude/skills/git`
+- Three logical commits were created on the dev branch: one for repo scaffolding (12 files), one for TimeWarp package/analyzer updates (including MessagePack vulnerability fix), and one for strict analyzer build fixes and runfile shebangs (58 files)
+- All verification checks passed green: solution 0 warnings/0 errors, 33/33 tests, 5/5 samples, audit 19/19
+- Changes were committed but not pushed to remote; Claude Code notified User that other worktrees (nuru, amuru, ganda, architecture) still have uncommitted `.editorconfig`/brace fixes
+

Directory.Packages.props

@@ -5,23 +5,24 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
   <ItemGroup Label="TimeWarp Packages">
-    <PackageVersion Include="TimeWarp.Amuru" Version="1.0.0-beta.34" />
+    <PackageVersion Include="TimeWarp.Amuru" Version="1.0.0" />
+    <PackageVersion Include="TimeWarp.Amuru.Tools" Version="1.0.0-beta.2" />
     <PackageVersion Include="TimeWarp.Builder" Version="1.0.0" />
-    <!-- Jaribu beta.12 pulls Amuru beta.21 -> StreamJsonRpc -> MessagePack 2.5.198,
-         which trips NU1902/NU1903 under our TreatWarningsAsErrors policy -->
-    <PackageVersion Include="TimeWarp.Jaribu" Version="1.0.0-beta.13" />
-    <PackageVersion Include="TimeWarp.Nuru" Version="3.0.0-beta.71" />
-    <PackageVersion Include="TimeWarp.Nuru.DevCli" Version="3.0.0-beta.71" />
+    <!-- Jaribu beta.12 pulled Amuru beta.21 -> StreamJsonRpc -> MessagePack 2.5.198
+         (NU1902/NU1903 under TreatWarningsAsErrors). beta.15 restores clean. -->
+    <PackageVersion Include="TimeWarp.Jaribu" Version="1.0.0-beta.15" />
+    <PackageVersion Include="TimeWarp.Nuru" Version="3.0.0-beta.76" />
+    <PackageVersion Include="TimeWarp.Nuru.DevCli" Version="3.0.0-beta.76" />
     <PackageVersion Include="TimeWarp.Build.Tasks" Version="1.0.0" />
   </ItemGroup>
   <ItemGroup Label="Testing">
     <PackageVersion Include="Shouldly" Version="4.3.0" />
   </ItemGroup>
   <ItemGroup Label="Code Analyzers">
-    <PackageVersion Include="Roslynator.Analyzers" Version="4.15.0" />
-    <PackageVersion Include="Roslynator.CodeAnalysis.Analyzers" Version="4.15.0" />
-    <PackageVersion Include="Roslynator.Formatting.Analyzers" Version="4.15.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.301" />
+    <PackageVersion Include="Roslynator.Analyzers" Version="4.16.0" />
+    <PackageVersion Include="Roslynator.CodeAnalysis.Analyzers" Version="4.16.0" />
+    <PackageVersion Include="Roslynator.Formatting.Analyzers" Version="4.16.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.400" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="5.6.0" />
   </ItemGroup>
 </Project>

kanban/done/024-add-trusted-publishing-probe-mode-to-workflowyml.md

@@ -0,0 +1,27 @@
+# Add trusted-publishing probe mode to workflow.yml
+
+## Description
+
+Org 458-009 probe (NuGet has no policy-enumeration API): a workflow_dispatch
+mode that runs ONLY the nuget/login OIDC exchange and stops — success proves an
+active trusted publishing policy matches this repo + workflow.yml. Reference:
+timewarp-nuru workflow.yml.
+
+## Checklist
+
+- [x] probe added to dispatch inputs
+- [x] nuget/login if-condition extended with the probe clause
+- [x] "Trusted publishing probe result" step added after login
+- [x] Pipeline/heavy steps skip in probe mode (or were already mode-gated)
+- [x] YAML validated
+
+## Results
+
+Implemented directly by the 458 orchestration session (2026-08-08) after the
+delegated batch worker for this repo died mid-wave.
+
+### How to validate
+
+Smoke: after push, `gh workflow run workflow.yml -f mode=probe` → expect the
+run to succeed with the probe-result step green. A failure at the NuGet login
+step means the trusted publishing policy is missing/misconfigured on NuGet.org.

kanban/done/025-bring-repo-audit-clean-on-timewarpnurudevcli-300-beta72.md

@@ -0,0 +1,74 @@
+# Bring repo audit-clean on TimeWarp.Nuru.DevCli 3.0.0-beta.72
+
+## Description
+
+Org wave (timewarp-nuru 458-010 remediation + DevCli 3.0.0-beta.72 adoption —
+they are the same wave: the audit's `nuru` check went red org-wide when
+beta.72 shipped, by design). Passing `ganda repo audit` now means adopting the
+full release toolkit: `dev release`, promotion gates, attestation verifier,
+trusted-publishing probe, derived package sets.
+
+## Checklist
+
+- [x] `ganda repo audit --fix` (bumps TimeWarp.Nuru/DevCli to latest, fixes kebab/structure where fixable)
+- [x] Verify Directory.Packages.props pins TimeWarp.Nuru.DevCli (and TimeWarp.Nuru where referenced) at 3.0.0-beta.72
+- [x] Build — NURU050 names any missing DI registration (e.g. `IPackableProjectService`); add per the DevCli readme migration notes (CS0101 local-CiMode note also applies)
+- [x] `dev self-install` (AOT binary is a snapshot; new commands like `release` are absent until reinstalled)
+- [x] `ganda repo audit` → PASSES ALL CHECKS (if a check is structurally unfixable here, record it explicitly with a reason instead of forcing)
+- [x] Smoke: `dev --help` shows `release`; `dev check-version` derives the packable set (publishers only)
+- [x] Commit everything (audit fixes, props, dev.cs, kanban) — local commits fine; ride the repo's normal merge flow
+
+## Notes
+
+Created 2026-08-08 from the nuru 458 program session. timewarp-nuru is the
+reference (audit-clean at beta.72, first release shipped through the full
+machinery).
+
+### Implementation notes (2026-08-08)
+
+**Before audit:** 18 pass / 2 fail — `nuru` (beta.71) + `kebab-path-names` (5 paths).
+
+**After:** `ganda repo audit` → 20 pass / 0 fail.
+
+Hand fixes beyond `--fix`:
+- `TimeWarp.Nuru.DevCli` pin was still beta.71 after `--fix` (only Nuru was bumped) → set to `3.0.0-beta.72`
+- `TimeWarp.Amuru` → `1.0.0` (NU1605: Nuru beta.72 requires Amuru ≥1.0.0)
+- Added `TimeWarp.Amuru.Tools` `1.0.0-beta.2` (IRepoCleanService moved out of core Amuru at 1.0.0)
+- DI: removed `GitTagCheckService` (gone from DevCli package), added `IPackableProjectService`/`PackableProjectService`
+- NoWarn for IDE0022/IDE0046/IDE0066/IDE0078 on DevCli content files from NuGet cache
+- `ganda repo audit --fix --checks kebab-path-names` renamed `LICENSE`→`license`, `README.md`→`readme.md`, and three workspace underscore filenames
+
+## Results
+
+Repo is audit-clean on TimeWarp.Nuru / DevCli **3.0.0-beta.72**. Dev CLI builds, self-installs, exposes `release`, and `check-version` runs against the packable set.
+
+### How to validate
+
+**Smoke**
+```bash
+cd /home/steve/worktrees/github.com/TimeWarpEngineering/timewarp-terminal/dev
+grep -E 'TimeWarp\.(Nuru|Amuru)' Directory.Packages.props
+# Expect: Nuru + DevCli 3.0.0-beta.72; Amuru 1.0.0; Amuru.Tools 1.0.0-beta.2
+
+ganda repo audit
+# Expect: Repository passes all audit checks.
+
+./bin/dev --help
+# Expect: commands include release, check-version, clean, self-install
+
+./bin/dev check-version
+# Expect: reports packable package(s); may say version already released (1.0.0) — not a failure of the wave
+```
+
+**Automated gate**
+```bash
+ganda repo audit   # exit 0
+```
+
+**Depends on / Not in scope**
+- Local commits only; no push
+- Full solution test suite / NuGet publish not required for this task
+
+## Session
+
+- Implementation: grok (2026-08-08) — audit --fix + hand pins/DI/Amuru.Tools + kebab fix + self-install

kanban/done/026-update-outdated-nuget-package-pins.md

@@ -0,0 +1,98 @@
+# Update outdated NuGet package pins
+
+## Description
+
+`ganda repo audit` is red on the `nuru` check (`TimeWarp.Nuru` 3.0.0-beta.72 <
+3.0.0-beta.76). Bump every outdated central pin in `Directory.Packages.props`
+via `ganda nuget outdated --update --force` and restore a green build, test
+suite, samples, and repo audit.
+
+Dry-run targets (do not jump to preview streams such as NetAnalyzers
+`11.0.100-preview` or Roslynator `4.0.0-rc`):
+
+- TimeWarp.Jaribu `1.0.0-beta.13` → `1.0.0-beta.15`
+- TimeWarp.Nuru `3.0.0-beta.72` → `3.0.0-beta.76`
+- TimeWarp.Nuru.DevCli `3.0.0-beta.72` → `3.0.0-beta.76`
+- Roslynator.Analyzers / CodeAnalysis / Formatting `4.15.0` → `4.16.0`
+- Microsoft.CodeAnalysis.NetAnalyzers `10.0.301` → `10.0.400`
+
+## Requirements
+
+- All pins come from `ganda nuget outdated --update --force` (or equivalent
+  edits to `Directory.Packages.props` that match that dry-run)
+- Solution builds with 0 warnings / 0 errors under existing TreatWarningsAsErrors
+- `./bin/dev test` and `./bin/dev verify-samples` pass
+- `ganda repo audit` exits 0
+- If DevCli/Nuru APIs or content files change: update `tools/dev-cli/dev.cs`
+  registrations and NoWarns, then `dev self-install`
+- Record any structurally unfixable audit check with a reason instead of forcing
+
+## Checklist
+
+- [x] Create task and move to in-progress
+- [x] `ganda nuget outdated --update --force`
+- [x] Verify `Directory.Packages.props` matches the dry-run versions
+- [x] Build; fix DI / API / analyzer breaks from the bumps
+- [x] `dev self-install` if DevCli content or commands changed
+- [x] `dev test` and `dev verify-samples`
+- [x] `ganda repo audit` passes
+- [x] Commit pins, follow-up fixes, and this task card
+
+## Notes
+
+Followed task 025 (beta.72 adoption): last bump needed Amuru.Tools, DI
+registration (`IPackableProjectService`), DevCli cache NoWarns, and kebab
+renames. Expect similar NURU050 / NU1605 / new analyzer diagnostics.
+
+### Implementation notes (2026-08-16)
+
+`ganda nuget outdated --update --force` applied all seven dry-run pins. No
+preview-stream jumps (NetAnalyzers stayed on 10.0.400, not 11.0.100-preview;
+Roslynator stayed on 4.16.0, not 4.0.0-rc).
+
+No product or DevCli code changes: `dotnet run --file tools/dev-cli/dev.cs -- --help`
+still exposes the same commands; existing DI registrations compiled. Self-install
+skipped (AOT snapshot already has `release` / `check-version`; no new endpoints).
+
+Jaribu beta.15 restored clean (no NU1902/NU1903). Build needed a local empty
+`smoke` NuGet feed directory
+(`timewarp-architecture/dev/artifacts/template-smoke/packages`) because that
+user-level source is missing; not a repo change.
+
+## Results
+
+All central pins are current. Audit is green on Nuru 3.0.0-beta.76.
+
+### How to validate
+
+**Smoke**
+```bash
+cd /home/steve/worktrees/github.com/TimeWarpEngineering/timewarp-terminal/dev
+grep -E 'TimeWarp\.(Nuru|Jaribu)|Roslynator|NetAnalyzers' Directory.Packages.props
+# Expect: Nuru + DevCli 3.0.0-beta.76; Jaribu 1.0.0-beta.15;
+#         Roslynator* 4.16.0; NetAnalyzers 10.0.400
+
+ganda nuget outdated
+# Expect: All packages are up to date!
+
+ganda repo audit
+# Expect: Repository passes all audit checks (nuru included).
+```
+
+**Automated gate**
+```bash
+dotnet build timewarp-terminal.slnx -c Release   # 0 warnings / 0 errors
+./bin/dev test                                   # 33/33
+./bin/dev verify-samples                         # 5/5
+ganda repo audit                                 # exit 0
+```
+
+**Depends on / Not in scope**
+- Did not take NetAnalyzers 11.0.100-preview or Roslynator 4.0.0-rc
+- Did not self-install `bin/dev` (no command/DI surface change)
+- Local commits only; no push
+
+## Session
+
+- Created: grok (2026-08-16)
+- Implementation: grok (2026-08-16)

kanban/to-do/023-add-timewarpterminallayout-package-flexbox-composed-layouts.md

@@ -0,0 +1,81 @@
+# Add TimeWarp.Terminal.Layout package - flexbox-composed layouts
+
+## Description
+
+New companion package `TimeWarp.Terminal.Layout` (in this repo as
+`source/timewarp-terminal-layout/`) that composes existing widgets — panels, tables,
+rules, text — into flexbox layouts using TimeWarp.Flexbox (the C# Yoga port, verified
+against Yoga's 530-test conformance suite). Fills the biggest functional gap vs
+Spectre.Console: today every widget renders solo at full terminal width; there is no
+way to put two panels side by side, build a status-bar row, or compose a dashboard.
+
+One-shot render for ordinary scrolling CLI output (the `dev`/`ganda` style), NOT an
+interactive full-screen framework — that is timewarp-tui's job. This package is also
+the low-stakes proving ground for the float-layout → character-cell integration that
+timewarp-tui will inherit.
+
+Companion package (not a TimeWarp.Terminal dependency) keeps Terminal's dependency
+surface at exactly one stable package for users who just want colored output.
+
+## Gates (must clear before work starts)
+
+- [ ] TimeWarp.Flexbox published as a STABLE release on public nuget.org
+      (currently 1.0.0-beta.3 on private GitHub Packages; a public package cannot
+      depend on it — same NU5104/private-feed gate as the TimeWarp.Builder story)
+- [ ] TimeWarp.Flexbox passes trim/AOT analysis (Terminal earns its IsAotCompatible
+      claim; the layout package must not regress that)
+
+## Checklist
+
+- [ ] Create `source/timewarp-terminal-layout/` project (IsPackable, same strict
+      analyzer set, PackageReadmeFile/snupkg like the main package)
+- [ ] Solve float → character-cell rounding: Yoga computes float positions/sizes;
+      terminal cells are integers. Decide the rounding contract (Yoga has pixel-grid
+      rounding — evaluate whether PointScaleFactor=1 gives stable integer cells) and
+      pin it with tests: adjacent items must tile exactly (no gaps/overlaps), total
+      width must equal the container width
+- [ ] Design the item model: existing widgets (Panel, Table, Rule) plus raw text as
+      flex items; widgets need measure functions (content min/max width) wired to
+      flexbox measure callbacks, using UnicodeWidth/AnsiStringUtils for visible width
+- [ ] LayoutBuilder API consistent with existing builders (see sketch below);
+      `terminal.WriteLayout(...)` extension + static facade mirror
+- [ ] Respect SupportsColor gating and WindowWidth like existing widget extensions
+- [ ] Wrapping/overflow semantics: FlexWrap for rows of cards; min-width collapse
+      behavior when the terminal is too narrow (reuse the Grow-floor philosophy from
+      table: items never collapse to zero silently)
+- [ ] Runfile tests under tests/ (layout-01-basic, row/column, grow, wrap, nesting,
+      emoji/ANSI content inside items) + samples/layout-dashboard.cs
+- [ ] Release pipeline: pack/push both packages (workflow.cs pack step currently
+      packs only timewarp-terminal.csproj); check-version must gate on both ids
+
+## API Sketch
+
+```csharp
+terminal.WriteLayout(layout => layout
+  .Direction(FlexDirection.Row)
+  .Gap(2)
+  .Item(i => i.Grow(1), panel => panel.Header("Build").Content(buildSummary))
+  .Item(i => i.Grow(2), table => table.AddColumns("Test", "Result").AddRow(...))
+);
+
+// Column of rows (dashboard)
+terminal.WriteLayout(layout => layout
+  .Direction(FlexDirection.Column)
+  .Row(r => r.Item(statusPanel).Item(versionPanel))
+  .Row(r => r.Item(i => i.Grow(1), logTable))
+);
+```
+
+## Notes
+
+- Part of the layered stack: flexbox (pure layout math, leaf) → terminal (I/O
+  foundation, shipped 1.0.0 2026-07-03) → Terminal.Layout (static composition) →
+  timewarp-tui (interactive OpenTUI clone). See timewarp-tui card 262 for the
+  shared-primitives decision that should land before/alongside this.
+- Do NOT retrofit the table widget's internal column math onto flexbox: that code is
+  correct, regression-tested, and shipped in 1.0; swapping it would churn observable
+  output (rounding) for no user-visible gain.
+
+## Session
+
+- Created: 096d9aa9-8cec-4987-a576-91698523d859 (2026-07-03)

source/Directory.Build.props

@@ -4,7 +4,7 @@
 
   <!-- Default package metadata (can be overridden in individual projects) -->
   <PropertyGroup Label="Package Metadata">
-    <Version>1.0.0</Version>
+    <Version>1.0.1</Version>
     <Authors>Steven T. Cramer</Authors>
     <RepositoryUrl>https://github.com/TimeWarpEngineering/timewarp-terminal</RepositoryUrl>
     <RepositoryType>git</RepositoryType>