chore: propagate Beads 1.2.2 and GC 3307

.beads/config.yaml

@@ -3,16 +3,16 @@
 # @flext-ssot: config/workspace.yaml (ledger_id) + flext-infra config/codegen.yaml (toolchain.beads.server)
 # @flext-maintenance: do not edit generated projections; edit the SSOT and regenerate
 # Generated by `flext-infra gen conform`.
-# Source: issue_prefix/database = workspace manifest ledger_id (config key:
-# ledger_id) falling back to the canonical project name when undeclared.
+# Source: database and default issue prefix = workspace manifest ledger_id;
+# ledger_prefix is an optional distinct issue-prefix override.
 # Source: dolt server block = flext-infra config/codegen.yaml
 # toolchain.beads.server (machine-wide shared Dolt server facts).
-# Routing-only client config: this attached standalone owns no tracker state;
-# bd commands route to the shared ledger below. Local data is never written.
+# Owned ledger config: the workspace root owns this tracker; conform
+# initializes and verifies it against the pinned binary.
 issue-prefix: "mro"
 
-# Dolt shared-server connection (machine-wide shared server on :3308).
-# The `mro` database lives there; a repository-local server is never used.
+# Dolt server connection (Gas Town town server on :3307).
+# The `flext` database lives there; a repository-local server is never used.
 dolt:
   mode: server
   shared-server: false
@@ -21,3 +21,4 @@ dolt:
   user: root
   database: flext
   auto-commit: "on"
+prefix: "flext"

.beads/metadata.json

@@ -3,6 +3,6 @@
   "backend": "dolt",
   "dolt_mode": "server",
   "dolt_database": "flext",
-  "dolt_server_port": 3307,
-  "dolt_server_host": "127.0.0.1"
+  "dolt_server_host": "127.0.0.1",
+  "dolt_server_port": 3307
 }

.envrc

@@ -17,7 +17,14 @@ watch_file pyproject.toml
 PROJECT_ROOT="$(find_up pyproject.toml)"
 PROJECT_ROOT="${PROJECT_ROOT%/*}"
 VENV_DIR="${PROJECT_ROOT}/.venv"
+PROJECT_SCRATCH="${PROJECT_ROOT}/.test-tmp"
+mkdir -p "${PROJECT_SCRATCH}"
+if command -v chattr >/dev/null 2>&1 && [[ "$(stat -f -c %T "${PROJECT_SCRATCH}")" == "btrfs" ]]; then
+  chattr +C "${PROJECT_SCRATCH}"
+fi
 export PROJECT_ROOT
+export TMPDIR="${PROJECT_SCRATCH}"
+export GOTMPDIR="${PROJECT_SCRATCH}"
 export PYTHON_KEYRING_BACKEND="keyring.backends.null.Keyring"
 # mro-38p39 (cProfile evidence): PYTHONDONTWRITEBYTECODE=1 disabled the import
 # cache, so every CLI invocation recompiled ~935 modules — 1.72s of pure

.github/workflows/ci.yml

@@ -72,8 +72,6 @@ jobs:
             testmon-v1-${{ runner.os }}-${{ runner.arch }}-py3.13-${{ hashFiles('uv.lock', '**/uv.lock') }}-
             testmon-v1-${{ runner.os }}-${{ runner.arch }}-py3.13-
 
-
-
       - name: setup (blocking)
         # Why (mro-v4p5): explicit CI=Y on every make invocation (job env is not enough for matrix/docker parity).
         run: CI=Y make setup
@@ -94,6 +92,18 @@ jobs:
         # Why (mro-v4p5): explicit CI=Y on every make invocation (job env is not enough for matrix/docker parity).
         run: CI=Y make check
 
+      # Why (aihub-v01jg): CI=Y runs ONE HALF of the gate set
+      # (lint pyright security markdown smells); the complement
+      # (pyrefly mypy) is owned by
+      # CI=N and, without this step, ran on developer
+      # machines only. That split let real defects reach main twice: five
+      # missing-attribute errors and an inconsistent-inheritance error, each
+      # green in CI and red locally. The two contexts are strict complements by
+      # construction, so running both here costs one extra pass and closes the
+      # hole rather than trusting everyone to run the other half by hand.
+      - name: check complement (blocking)
+        run: CI=N make check
+
       - name: Dump reports on failure
         if: ${{ failure() }}
         run: |

.gitignore

@@ -210,6 +210,7 @@ secrets.yml
 .beads/.*
 !.beads/config.yaml
 .beads/proxieddb/
+.beads.gate.lock
 .dolt/
 *.db
 .beads-credential-key
@@ -243,6 +244,7 @@ __pyrefly_virtual__/
 .omo/
 .pylance_cache/
 .pytest_cache/
+.test-tmp/
 .testmondata
 .testmondata-wal
 .testmondata-shm

.mise.toml

@@ -12,18 +12,28 @@
 #          gitleaks_version, tokei_version, qlty_version, beads.selector, beads.version)
 [tools]
 python = "3.13"
+# uv is deliberately absent: codegen.yaml declares it "supplied by the caller
+# environment and deliberately not pinned", and no `uv_version` exists on the
+# toolchain SSOT to render. Emitting one made every conform run fail with
+# "'uv_version' is undefined". The minimum version is enforced where it is
+# actually observable instead — tool_bootstrap_recipe.j2 compares the running
+# `uv --version` against its floor during `make setup`.
 # Native toolchain (single source: Infra.codegen.toolchain in codegen.yaml).
-kubectl = "1.32.0"
-helm = "3.19.4"
-kind = "0.31.0"
-taplo = "0.10.0"
-ast-grep = "0.45.0"
-gitleaks = "8.30.1"
-tokei = "14.0.0"
+kubectl = "1.32"
+helm = "3.19"
+kind = "0.31"
+taplo = "0.10"
+ast-grep = "0.45"
+gitleaks = "8.30"
+tokei = "14.0"
 # qlty ships no mise registry alias; the github backend selector is the only
 # resolvable form (bare 'qlty' fails mise install: 'not found in registry').
-"github:qltysh/qlty" = "0.642.0"
+"github:qltysh/qlty" = "0.642"
 # Go runtime for the Go projects in this workspace.
-go = "1.26.5"
-"github:marlon-costa-dc/beads" = "1.1.2-dc1"
+go = "1.26"
+[tools."github:marlon-costa-dc/beads"]
+version = "latest"
+prerelease = true
+minimum_release_age = "0s"
+
 # End SECTION: tools

.pre-commit-config.yaml

@@ -23,113 +23,6 @@ repos:
       # and write intent cannot leak into an independently declared hook step.
       # A step declaring gates_skip (mro-ucxgl) narrows CHECK_GATES for the hook
       # context only: local `make check` and the `docs` verb keep the full set.
-
-      - id: flext-pre-commit-setup
-        name: make setup
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make setup'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: flext-pre-commit-gen
-        name: make gen APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make gen APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: flext-pre-commit-fmt
-        name: make fmt APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make fmt APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: flext-pre-commit-fix
-        name: make fix APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make fix APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-      - id: flext-pre-commit-check
-        name: make check
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=Y make check'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-
-
-      - id: flext-pre-push-setup
-        name: make setup
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make setup'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-gen
-        name: make gen APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make gen APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-fmt
-        name: make fmt APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make fmt APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-fix
-        name: make fix APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make fix APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-check
-        name: make check
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make check'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-test-cache-clear
-        name: make test WHAT=cache-clear APPLY=Y
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make test WHAT=cache-clear APPLY=Y'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
-      - id: flext-pre-push-test-full
-        name: make test WHAT=full
-        language: system
-        entry: >-
-          bash -eu -o pipefail -c 'scope() { if [ -f "$(git rev-parse --show-toplevel)/.gitmodules" ]; then echo "workspace type (.gitmodules): hook gates are self-scope only; member hooks and push CI own member gates"; return 1; fi; return 0; }; scope || exit 0; guard() { local branch=$(git branch --show-current); if [[ "$branch" =~ ^wip/ ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if [[ "$branch" =~ WIP ]]; then echo "WIP branch $branch: skipping pre-push gate"; return 1; fi; if command -v gh >/dev/null 2>&1; then local draft=$(gh pr view --json isDraft --jq ".isDraft" 2>/dev/null); if [ -z "$draft" ]; then echo "PR state unresolvable: skipping pre-push gate (fail-open)"; return 1; fi; if [ "$draft" = "true" ]; then echo "DRAFT PR: skipping pre-push gate"; return 1; fi; else echo "gh unavailable: skipping pre-push gate (fail-open)"; return 1; fi; return 0; }; guard || exit 0; unset $(git rev-parse --local-env-vars); unset WHAT MAKEFLAGS APPLY; CI=N make test WHAT=full'
-        pass_filenames: false
-        always_run: true
-        stages: [pre-push]
-
+      # Stage gates (operator law 2026-08-24): each stage renders only when its
+      # config gate (make.pre_commit / make.pre_push) is enabled. Disabled by
+      # default; re-enable case by case in config/codegen.yaml.

.vscode/settings.json

@@ -58,7 +58,8 @@
     "**/.bkp": true,
     "**/.testmondata": true,
     "**/.testmondata-wal": true,
-    "**/.testmondata-shm": true
+    "**/.testmondata-shm": true,
+    "**/.test-tmp": true
   },
   "files.watcherExclude": {
     "**/__pycache__/**": true,
@@ -104,7 +105,8 @@
     "**/.bkp/**": true,
     "**/.testmondata/**": true,
     "**/.testmondata-wal/**": true,
-    "**/.testmondata-shm/**": true
+    "**/.testmondata-shm/**": true,
+    "**/.test-tmp/**": true
   },
   "search.exclude": {
     "**/__pycache__": true,
@@ -149,7 +151,8 @@
     "**/.bkp": true,
     "**/.testmondata": true,
     "**/.testmondata-wal": true,
-    "**/.testmondata-shm": true
+    "**/.testmondata-shm": true,
+    "**/.test-tmp": true
   },
   "python.analysis.diagnosticSeverityOverrides": {
     "reportUntypedBaseClass": "none"