feat: define atomic capability contract v1

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.githooks/pre-push

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+set -eu
+
+repo_root="$(git rev-parse --show-toplevel)"
+queue_command="$repo_root/node_modules/.bin/claude-code-merge-queue"
+
+# Git for Windows can prepend user shim directories ahead of the Windows Python
+# launcher. Keep the native launcher discoverable so the CPython 3.14 acceptance
+# lane behaves the same in pre-push as it does in PowerShell.
+if [ -n "${LOCALAPPDATA:-}" ] && command -v cygpath >/dev/null 2>&1; then
+  windows_apps="$(cygpath -u "$LOCALAPPDATA")/Microsoft/WindowsApps"
+  PATH="$windows_apps:$PATH"
+  export PATH
+fi
+
+if [ ! -f "$queue_command" ]; then
+  printf '%s\n' 'pre-push: repository-local claude-code-merge-queue is missing; run Install-MultiAgentMergeQueue.ps1.' >&2
+  exit 1
+fi
+
+payload="$(mktemp "${TMPDIR:-/tmp}/code-intel-pre-push.XXXXXX")"
+trap 'rm -f "$payload"' EXIT HUP INT TERM
+cat >"$payload"
+
+# Required landing guard: claude-code-merge-queue check-push
+if ! "$queue_command" check-push "$@" <"$payload"; then
+  exit 1
+fi
+
+previous_hooks_path="$(git config --local --get codeIntel.mergeQueue.previousHooksPath || true)"
+if [ -n "$previous_hooks_path" ]; then
+  case "$previous_hooks_path" in
+    /* | [A-Za-z]:/*) previous_hook="$previous_hooks_path/pre-push" ;;
+    *) previous_hook="$repo_root/$previous_hooks_path/pre-push" ;;
+  esac
+
+  current_hook="$repo_root/.githooks/pre-push"
+  if [ -f "$previous_hook" ] && [ "$previous_hook" != "$current_hook" ]; then
+    if [ -x /usr/bin/bash ]; then
+      /usr/bin/bash "$previous_hook" "$@" <"$payload"
+    else
+      sh "$previous_hook" "$@" <"$payload"
+    fi
+  fi
+fi

.github/workflows/ci.yml

@@ -17,16 +17,22 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - name: Setup Rust
         shell: pwsh
         run: rustup default stable
 
+      - name: Install ripgrep
+        shell: pwsh
+        run: choco install ripgrep -y --no-progress
+
       - name: Rust format
         shell: pwsh
         run: cargo fmt -p code-intel -- --check
@@ -35,10 +41,14 @@ jobs:
         shell: pwsh
         run: cargo check
 
-      - name: Rust tests
+      - name: Rust tests and core cross-contract gate
         shell: pwsh
         run: cargo test -p code-intel
 
+      - name: Representative project orientation benchmark
+        shell: pwsh
+        run: cargo test -p code-intel --test project_orientation_benchmark -- --nocapture
+
       - name: Build Rust CLI
         shell: pwsh
         run: cargo build -p code-intel --release
@@ -47,18 +57,30 @@ jobs:
         shell: pwsh
         run: |
           $files = @(
+            "invoke-code-intel.ps1",
             "run-code-intel.ps1",
             "Invoke-ScopedRepowise.ps1",
             "Find-CodeIntelProjects.ps1",
             "Invoke-GitHubSolutionResearch.ps1",
             "test-code-intel-pipeline.ps1",
+            "test-stable-wrapper-e2e.ps1",
             "test-github-solution-research.ps1",
             "test-hospital-trust-contract.ps1",
+            "test-atomic-capability-contract.ps1",
             "test-project-discovery.ps1",
             "test-project-management-support.ps1",
+            "Test-CodeIntelProjectConformance.ps1",
+            "test-code-intel-project-conformance.ps1",
+            "Invoke-MultiAgentMergeQueue.ps1",
+            "test-multi-agent-merge-queue.ps1",
+            "test-integration-orchestration.ps1",
+            "Test-Python314PonCompatibility.ps1",
+            "test-python314-pon-compatibility.ps1",
             "test-scoped-repowise-security.ps1",
             "test-scoped-repowise-worktree.ps1",
-            "test-skill-development-benchmark.ps1"
+            "test-skill-development-benchmark.ps1",
+            "tools/New-BetaPackage.ps1",
+            "tools/Test-BetaPackage.ps1"
           )
           foreach ($file in $files) {
             $tokens = $null
@@ -98,20 +120,6 @@ jobs:
             throw "Secret-like patterns found."
           }
 
-      - name: Install ripgrep
-        shell: pwsh
-        run: |
-          if ($IsWindows) {
-            choco install ripgrep -y --no-progress
-          }
-          elseif ($IsMacOS) {
-            brew install ripgrep
-          }
-          else {
-            sudo apt-get update
-            sudo apt-get install -y ripgrep
-          }
-
       - name: Install portable pipeline
         shell: pwsh
         run: .\install-code-intel-pipeline.ps1 -RepoPath . -RepairSkillLinks -RequireRepowise:$false -Json
@@ -136,6 +144,10 @@ jobs:
         shell: pwsh
         run: .\test-project-management-support.ps1 -RepoPath .
 
+      - name: Atomic capability contract tests
+        shell: pwsh
+        run: .\test-atomic-capability-contract.ps1 -RepoPath .
+
       - name: Skill development benchmark contract tests
         shell: pwsh
         run: .\test-skill-development-benchmark.ps1 -RepoPath .
@@ -157,31 +169,37 @@ jobs:
         shell: pwsh
         run: .\test-regression-fixes.ps1
 
+      - name: Python 3.14 and project conformance
+        shell: pwsh
+        run: |
+          .\test-python314-pon-compatibility.ps1
+          .\test-integration-orchestration.ps1
+          .\test-code-intel-project-conformance.ps1
+
       - name: Pipeline smoke
         shell: pwsh
         run: .\test-code-intel-pipeline.ps1 -RepoPath . -SkipRepowise -AllowGraphMissing -SkipSentruxGate -SkipGitHubResearch -Mode normal
 
+      - name: Stable wrapper authoritative outcome E2E
+        shell: pwsh
+        run: .\test-stable-wrapper-e2e.ps1
+
       - name: Package
         shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force dist\code-intel-pipeline\bin | Out-Null
-          $files = git ls-files
-          foreach ($file in $files) {
-            if ($file -match "^\.gitignore$") {
-              continue
-            }
-            $target = Join-Path "dist\code-intel-pipeline" $file
-            New-Item -ItemType Directory -Force -Path (Split-Path -Parent $target) | Out-Null
-            Copy-Item -LiteralPath $file -Destination $target -Force
-          }
-          Copy-Item -LiteralPath target\release\code-intel.exe -Destination dist\code-intel-pipeline\bin\code-intel.exe -Force
-          Compress-Archive -Path dist\code-intel-pipeline -DestinationPath dist\code-intel-pipeline-windows.zip -Force
+        run: ./tools/New-BetaPackage.ps1 -ExecutablePath ./target/release/code-intel.exe -OutputDirectory ./dist -PackageName code-intel-pipeline-windows-beta
+
+      - name: Verify beta package
+        shell: pwsh
+        run: ./tools/Test-BetaPackage.ps1 -ZipPath ./dist/code-intel-pipeline-windows-beta.zip -Json
 
       - name: Upload package artifact
         uses: actions/upload-artifact@v4
         with:
           name: code-intel-pipeline-windows
-          path: dist/code-intel-pipeline-windows.zip
+          path: |
+            dist/code-intel-pipeline-windows-beta.zip
+            dist/code-intel-pipeline-windows-beta.zip.sha256
+            dist/code-intel-pipeline-windows-beta.release-manifest.json
 
   cross-platform-smoke:
     permissions:
@@ -200,16 +218,32 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.14"
 
       - name: Setup Rust
         shell: pwsh
         run: rustup default stable
 
+      - name: Install ripgrep
+        shell: pwsh
+        run: |
+          if ($IsWindows) {
+            choco install ripgrep -y --no-progress
+          }
+          elseif ($IsMacOS) {
+            brew install ripgrep
+          }
+          else {
+            sudo apt-get update
+            sudo apt-get install -y ripgrep
+          }
+
       - name: Rust format
         shell: pwsh
         run: cargo fmt -p code-intel -- --check
@@ -218,7 +252,7 @@ jobs:
         shell: pwsh
         run: cargo check
 
-      - name: Rust tests
+      - name: Rust tests and core cross-contract gate
         shell: pwsh
         run: cargo test -p code-intel
 
@@ -230,18 +264,30 @@ jobs:
         shell: pwsh
         run: |
           $files = @(
+            "invoke-code-intel.ps1",
             "run-code-intel.ps1",
             "Invoke-ScopedRepowise.ps1",
             "Find-CodeIntelProjects.ps1",
             "Invoke-GitHubSolutionResearch.ps1",
             "test-code-intel-pipeline.ps1",
+            "test-stable-wrapper-e2e.ps1",
             "test-github-solution-research.ps1",
             "test-hospital-trust-contract.ps1",
+            "test-atomic-capability-contract.ps1",
             "test-project-discovery.ps1",
             "test-project-management-support.ps1",
+            "Test-CodeIntelProjectConformance.ps1",
+            "test-code-intel-project-conformance.ps1",
+            "Invoke-MultiAgentMergeQueue.ps1",
+            "test-multi-agent-merge-queue.ps1",
+            "test-integration-orchestration.ps1",
+            "Test-Python314PonCompatibility.ps1",
+            "test-python314-pon-compatibility.ps1",
             "test-scoped-repowise-security.ps1",
             "test-scoped-repowise-worktree.ps1",
-            "test-skill-development-benchmark.ps1"
+            "test-skill-development-benchmark.ps1",
+            "tools/New-BetaPackage.ps1",
+            "tools/Test-BetaPackage.ps1"
           )
           foreach ($file in $files) {
             $tokens = $null
@@ -281,20 +327,6 @@ jobs:
             throw "Secret-like patterns found."
           }
 
-      - name: Install ripgrep
-        shell: pwsh
-        run: |
-          if ($IsWindows) {
-            choco install ripgrep -y --no-progress
-          }
-          elseif ($IsMacOS) {
-            brew install ripgrep
-          }
-          else {
-            sudo apt-get update
-            sudo apt-get install -y ripgrep
-          }
-
       - name: Install portable pipeline
         shell: pwsh
         run: |
@@ -309,9 +341,21 @@ jobs:
         shell: pwsh
         run: ./test-hospital-trust-contract.ps1
 
+      - name: Atomic capability contract tests
+        shell: pwsh
+        run: ./test-atomic-capability-contract.ps1 -RepoPath .
+
       - name: Scoped Repowise manifest validator tests
         run: python ./test-scoped-repowise-validator.py
 
+      - name: Python 3.14 compatibility lane
+        shell: pwsh
+        run: ./test-python314-pon-compatibility.ps1
+
+      - name: Multi-agent merge queue contract
+        shell: pwsh
+        run: ./test-multi-agent-merge-queue.ps1
+
       - name: Pipeline smoke
         shell: pwsh
         run: ./test-code-intel-pipeline.ps1 -RepoPath . -SkipRepowise -AllowGraphMissing -SkipSentruxCheck -SkipSentruxGate -SkipGitHubResearch -Mode normal