feat(tally): add resilient truth-layer integration

.gitattributes

@@ -0,0 +1,5 @@
+* text=auto eol=lf
+
+*.icns binary
+*.ico binary
+*.png binary

.github/workflows/ci.yml

@@ -51,6 +51,112 @@ jobs:
       - run: cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check
       - run: node scripts/check-dependency-inventory.mjs --rust
 
+  tally-portable:
+    name: Tally portable core
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          toolchain: 1.96.0
+          components: clippy
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: src-tauri -> target
+      - name: Test portable Tally truth layer
+        working-directory: src-tauri
+        run: >-
+          cargo test --locked
+          -p bridge-tally-canonical
+          -p bridge-tally-compatibility
+          -p bridge-tally-core
+          -p bridge-tally-incremental
+          -p bridge-tally-live-read
+          -p bridge-tally-observability
+          -p bridge-tally-protocol
+          -p bridge-tally-qualification
+          -p bridge-tally-read-transport
+          -p bridge-tally-runtime
+          -p bridge-tally-transport
+          -p bridge-tally-write
+          -p tally-protocol-simulator
+      - name: Test disabled protocol evidence features
+        working-directory: src-tauri
+        run: >-
+          cargo test --locked -p bridge-tally-protocol
+          --features jsonex-parser,jsonex-request-builder,india-tax-observation-parser,bills-payments-observation-parser,bills-native-outstandings-probe
+      - name: Test isolated native outstandings qualification path
+        working-directory: src-tauri
+        run: |
+          cargo test --locked -p bridge-tally-compatibility --features bills-native-outstandings-probe-receipt
+          cargo test --locked -p bridge-tally-read-transport --features bills-native-outstandings-probe-transport
+          cargo test --locked -p bridge-tally-live-read --features bills-native-outstandings-probe-runner -- --test-threads=1
+      - name: Lint portable Tally truth layer
+        working-directory: src-tauri
+        run: >-
+          cargo clippy --locked
+          -p bridge-tally-canonical
+          -p bridge-tally-compatibility
+          -p bridge-tally-core
+          -p bridge-tally-incremental
+          -p bridge-tally-live-read
+          -p bridge-tally-observability
+          -p bridge-tally-protocol
+          -p bridge-tally-qualification
+          -p bridge-tally-read-transport
+          -p bridge-tally-runtime
+          -p bridge-tally-transport
+          -p bridge-tally-write
+          -p tally-protocol-simulator
+          --all-targets -- -D warnings
+      - name: Lint disabled protocol evidence features
+        working-directory: src-tauri
+        run: >-
+          cargo clippy --locked -p bridge-tally-protocol
+          --features jsonex-parser,jsonex-request-builder,india-tax-observation-parser,bills-payments-observation-parser,bills-native-outstandings-probe
+          --all-targets -- -D warnings
+      - name: Lint isolated native outstandings qualification path
+        working-directory: src-tauri
+        run: |
+          cargo clippy --locked -p bridge-tally-compatibility --features bills-native-outstandings-probe-receipt --all-targets -- -D warnings
+          cargo clippy --locked -p bridge-tally-read-transport --features bills-native-outstandings-probe-transport --all-targets -- -D warnings
+          cargo clippy --locked -p bridge-tally-live-read --features bills-native-outstandings-probe-runner --all-targets -- -D warnings
+      - name: Produce parser-only synthetic qualification smoke receipt
+        working-directory: src-tauri
+        run: >-
+          cargo run --locked --release -p bridge-tally-qualification --
+          run ci-smoke target/tally-qualification-smoke.json 7 3
+      - name: Enforce exact Tally compatibility claims
+        working-directory: src-tauri
+        run: >-
+          cargo run --locked -p bridge-tally-compatibility --
+          gate
+          ../docs/tally/compatibility/compatibility-matrix.json
+          ../docs/tally/compatibility/compatibility-surface.json
+          ../docs/tally/compatibility/trusted-evidence-keys.json
+          ../docs/tally/compatibility/evidence
+          ..
+      - name: Reject generated Tally matrix drift
+        working-directory: src-tauri
+        run: >-
+          cargo run --locked -p bridge-tally-compatibility --
+          check-matrix-markdown
+          ../docs/tally/compatibility/compatibility-matrix.json
+          ../docs/tally/support-matrix.md
+      - name: Enforce no-write live-read dependency boundary
+        run: node scripts/check-tally-live-read-boundary.mjs
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tally-parser-qualification-smoke
+          path: src-tauri/target/tally-qualification-smoke.json
+          if-no-files-found: error
+          retention-days: 7
+
   native:
     name: Native checks (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
@@ -72,9 +178,30 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src-tauri -> target
-      - run: cargo check --locked --manifest-path src-tauri/Cargo.toml
-      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml
-      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
+      - name: Provision pinned Perl for vendored SQLCipher/OpenSSL
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install strawberryperl --version=5.42.2.1 --yes --no-progress
+          Add-Content -Path $env:GITHUB_ENV -Value 'OPENSSL_SRC_PERL=C:\Strawberry\perl\bin\perl.exe'
+          Add-Content -Path $env:GITHUB_ENV -Value 'LIBCLANG_PATH=C:\Program Files\LLVM\bin'
+          & 'C:\Strawberry\perl\bin\perl.exe' -MLocale::Maketext::Simple -e "print qq(Perl prerequisite ready\n)"
+          if (-not (Test-Path -LiteralPath 'C:\Program Files\LLVM\bin\libclang.dll')) { throw 'libclang.dll prerequisite missing' }
+      - run: cargo check --locked --manifest-path src-tauri/Cargo.toml --workspace
+      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml --workspace
+      - name: Test isolated native outstandings qualification feature
+        working-directory: src-tauri
+        run: >-
+          cargo test --locked -p bridge-tally-live-read
+          --features bills-native-outstandings-probe-runner
+          --all-targets -- --test-threads=1
+      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings
+      - name: Lint isolated native outstandings qualification feature
+        working-directory: src-tauri
+        run: >-
+          cargo clippy --locked -p bridge-tally-live-read
+          --features bills-native-outstandings-probe-runner
+          --all-targets -- -D warnings
 
   bundle-smoke:
     name: Bundle smoke (${{ matrix.os }})
@@ -101,6 +228,15 @@ jobs:
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: src-tauri -> target
+      - name: Provision pinned Perl for vendored SQLCipher/OpenSSL
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install strawberryperl --version=5.42.2.1 --yes --no-progress
+          Add-Content -Path $env:GITHUB_ENV -Value 'OPENSSL_SRC_PERL=C:\Strawberry\perl\bin\perl.exe'
+          Add-Content -Path $env:GITHUB_ENV -Value 'LIBCLANG_PATH=C:\Program Files\LLVM\bin'
+          & 'C:\Strawberry\perl\bin\perl.exe' -MLocale::Maketext::Simple -e "print qq(Perl prerequisite ready\n)"
+          if (-not (Test-Path -LiteralPath 'C:\Program Files\LLVM\bin\libclang.dll')) { throw 'libclang.dll prerequisite missing' }
       - run: corepack pnpm install --frozen-lockfile
       - run: corepack pnpm run license:all
       - run: corepack pnpm run tauri:build

.gitignore

@@ -6,6 +6,7 @@ node_modules/
 Thumbs.db
 Desktop.ini
 *.log
+.bridge-live/
 
 # Local environment and editor state. Keep examples tracked.
 .env

AGENTS.md

@@ -31,8 +31,10 @@ This document defines agent-level expectations and review responsibilities for t
   supersedes public issue/PR creation until coordinated disclosure is safe.
 - PRs that touch existing workflows must include rollback notes and migration compatibility.
 - Keep issue triage actionable:
-  - assign one area label (tally / dsc / documents / infra / security)
-  - set severity (`P1` urgent / `P2` production / `P3` medium / `P4` cleanup)
+  - assign exactly one area label (`area:tally`, `area:dsc`,
+    `area:documents`, `area:infra`, or `area:security`)
+  - set one bug severity label (`severity:p1` urgent / `severity:p2`
+    production impact / `severity:p3` medium / `severity:p4` cleanup)
   - avoid open "wip" tasks without acceptance evidence.
 - If regression was introduced by a specific PR, link it explicitly in the rectify issue and include it in the fix PR summary.
 - For non-security production regressions, use a dedicated fix branch and label (`type:rectify`).

BRIDGE_TALLY_RESEARCH_AND_CODEX_PLAN.md

@@ -0,0 +1,8 @@
+# Bridge Tally research and Codex plan
+
+The maintained plan now lives at
+[docs/tally/TALLY_INTEGRATION_RESEARCH_AND_CODEX_PLAN.md](./docs/tally/TALLY_INTEGRATION_RESEARCH_AND_CODEX_PLAN.md).
+
+Keep implementation status and public claims in the adjacent
+[Tally support matrix](./docs/tally/support-matrix.md); roadmap items are not
+support claims until their exact evidence is recorded there.

CHANGELOG.md

@@ -14,9 +14,37 @@ current source.
 - Relicensed future Bridge distributions from the MIT License to the Apache
   License, Version 2.0. The previously published `v0.1.0` release remains
   available under the MIT License that accompanied that release.
+- Core snapshot canaries now authorize attempts through stable observed
+  sealed-profile execution evidence without claiming field support from an
+  incidental first-day dataset; snapshot rows are always re-fetched after the
+  durable run starts.
+- A probe that no longer returns the selected company now clears and
+  invalidates every company-scoped evidence, proof, mirror, diagnostic, and
+  snapshot view before installing the replacement probe, so its fresh review
+  remains usable without displaying stale company data.
+- Snapshot lifecycle probes no longer replace interactive setup-review state;
+  restart admission uses the exact sealed Core receipt, and ambiguous duplicate
+  live company identities fail before any snapshot read with their concrete
+  terminal proof reason preserved.
+- Snapshot recovery now durably replays backward-clock abandonment evidence,
+  enforces a 100,000-record aggregate hydration ceiling, and recovers an exact
+  already-committed receipt from compact hash-bound proof authority without
+  rehydrating canonical membership.
 
 ### Added
 
+- A local-first Tally Truth Layer with capability passports, explicit truth
+  states, encrypted mirror evidence, resumable/adaptive snapshots, Proof of
+  Sync and Gap Map output, and a safer operator console. The migrations are
+  additive; rollback requires restoring the prior application and retaining
+  the encrypted database for forward recovery rather than deleting evidence.
+- Portable, bounded Tally protocol, canonicalization, transport, runtime,
+  compatibility, incremental-policy, qualification, observability, and
+  write-safety crates backed by a synthetic loopback protocol simulator.
+- Reviewed single-use setup authority, exact selected-read qualification, and
+  fail-closed compatibility manifests/runbooks. Live Education behavior and
+  every write capability remain unknown or disabled until exact reviewed
+  evidence exists.
 - Native Windows and macOS CI coverage for formatting, tests, builds, and
   Clippy.
 - Repository-local Windows and macOS application icons.
@@ -28,6 +56,26 @@ current source.
 
 ### Security
 
+- SQLCipher/keyring-backed local Tally state, immutable proof/checkpoint
+  receipts, loopback-only proxy-free HTTP, bounded incremental decoding,
+  cancellation and lease enforcement, idempotent crash replay, and sealed
+  no-write qualification boundaries.
+- SQLCipher pool replacement connections now receive raw key bytes from
+  zeroizing storage without retaining a key-derived pragma string. Proof
+  contract v3 binds detailed record counts, and historical crash recovery no
+  longer depends on current checkpoint ownership.
+- File-backed snapshot ownership now uses per-run kernel advisory locks, so a
+  crash can be reclaimed after wall-clock rollback without allowing a live
+  owner to be stolen. Persisted/live company profiles correlate through an
+  opaque endpoint-scoped identity key, and macOS qualification reports
+  `ru_maxrss` in its native byte units.
+- Losing checkpoint compare-and-swap decisions terminalize as durable failed
+  proofs and close staging attempts instead of remaining falsely resumable;
+  unrelated checkpoint advances do not rewrite Failed or Cancelled outcomes.
+- Compatibility claims now require verified synthetic-fixture identity before
+  an explicit parsed Tally application rejection can establish `Unsupported`;
+  fixture, context, sentinel, parser, malformed-response, and transport
+  failures remain fail-closed observations rather than incompatibility claims.
 - Updated the XML parsing graph and removed unused Linux-only dialog
   dependencies from the supported Windows and macOS build graph.
 - Updated the Tauri runtime to 2.11.5 and tauri-runtime-wry to 2.11.4.

CONTRIBUTING.md

@@ -23,7 +23,12 @@ Bridge supports development on Windows and macOS. Install a supported Node.js
 22 or 24 release, Corepack, the Rust toolchain selected by
 `rust-toolchain.toml`, and the
 [Tauri prerequisites](https://v2.tauri.app/start/prerequisites/) for the host
-operating system. Then run from any local clone:
+operating system. The bundled SQLCipher/OpenSSL build also requires Perl 5 with
+`Locale::Maketext::Simple`; on Windows, use a complete distribution such as
+Strawberry Perl and set `OPENSSL_SRC_PERL` if an incomplete Perl appears first
+on `PATH`. SQLCipher binding generation also requires LLVM/libclang; set
+`LIBCLANG_PATH` to the directory containing `libclang.dll` when it is not
+discoverable automatically. Then run from any local clone:
 
 ```text
 corepack pnpm install --frozen-lockfile

NOTICE

@@ -20,3 +20,30 @@ Bridge does not ship a local `pkcs11-docs/` directory. The upstream dependency
 source and referenced material are available at:
 
     https://github.com/MarcusGrass/rust-pkcs11
+
+-------------------------------------------------------------------------------
+SQLCipher
+Copyright (c) 2008-2020 Zetetic LLC
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the ZETETIC LLC nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY ZETETIC LLC ''AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL ZETETIC LLC BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -18,11 +18,17 @@ Shared prerequisites:
 
 - Node.js 22 or 24 and Corepack (`.node-version` pins the CI baseline)
 - the Rust toolchain pinned by `rust-toolchain.toml`
+- Perl 5 with `Locale::Maketext::Simple` for the bundled SQLCipher/OpenSSL build
+- LLVM/libclang for SQLCipher binding generation (`LIBCLANG_PATH` may be required)
 - the operating-system dependencies listed in the
   [Tauri prerequisites](https://v2.tauri.app/start/prerequisites/)
 
-On Windows, install the Microsoft C++ build tools and WebView2 components
-described by Tauri. On macOS, install Xcode Command Line Tools. DSC workflows
+On Windows, install the Microsoft C++ build tools, WebView2 components, and a
+complete Perl distribution such as Strawberry Perl. If another incomplete
+`perl.exe` appears first on `PATH`, set `OPENSSL_SRC_PERL` to the complete Perl
+executable. Install LLVM as well; if `libclang.dll` is not discoverable, set
+`LIBCLANG_PATH` to its directory (commonly `C:\Program Files\LLVM\bin`). On
+macOS, install Xcode Command Line Tools. DSC workflows
 also require a vendor PKCS#11 library compatible with the host operating
 system; never commit a private key, PIN, certificate dump, or locally installed
 vendor library.