v1 audit: integrated worklist (45 tickets, full CI green)

.claude/project/followups/CLOSED.md

@@ -1 +1,2 @@
 - 2026-06-06 mssql-build-non-idempotent-create-type — "MSSQL build non-idempotent: bare CREATE TYPE blocks db.reset() rebuild" — *(closed 2026-06-06)*
+- 2026-07-13 v1-38-sdk-integration-f-2 — "dt reader .dtz bad-path hangs instead of rejecting (unforwarded gunzip stream error)" — *(closed 2026-07-13)*

.claude/project/followups/INDEX.md

@@ -2,24 +2,26 @@
 
 Auto-generated by `atomic followups render`. Do not edit.
 
-Open: 7  •  Stale: 0  •  Last rendered: 2026-07-08
+Open: 10  •  Stale: 0  •  Last rendered: 2026-07-14
 
 ## 📋 plans (1)
 
 - [configurable-sql-function-policy](configurable-sql-function-policy.md) — Configurable per-config SQL function allow/deny list + TUI editor → src/core/policy/classify.ts:79 (DESTRUCTIVE_FUNCTIONS)
 
-## 🟡 risks (4)
+## 🟡 risks (6)
 
-- [config-module-scope-env-snapshot](config-module-scope-env-snapshot.md) — Move makeNestedConfig to call-time in config module (37d)
-- [downgrade-unprotects-configs](downgrade-unprotects-configs.md) — Downgrade after schemaVersion-2 migration silently unprotects all configs (0d)
-- [policy-denial-observability](policy-denial-observability.md) — Policy denials leave no server-side trace; MCP server never inits logger (0d)
-- [state-enc-atomic-write-lock](state-enc-atomic-write-lock.md) — state.enc: atomic write + inter-process lock + pre-migration backup (0d)
+- [config-module-scope-env-snapshot](config-module-scope-env-snapshot.md) — Move makeNestedConfig to call-time in config module (43d)
+- [db-transfer-no-fk-negation-collision](db-transfer-no-fk-negation-collision.md) — citty --no-fk/--no-identity never actually toggle (negation collision) (1d)
+- [downgrade-unprotects-configs](downgrade-unprotects-configs.md) — Downgrade after schemaVersion-2 migration silently unprotects all configs (6d)
+- [policy-denial-observability](policy-denial-observability.md) — Policy denials leave no server-side trace; MCP server never inits logger (6d)
+- [state-enc-atomic-write-lock](state-enc-atomic-write-lock.md) — state.enc: atomic write + inter-process lock + pre-migration backup (6d)
+- [v1-45-rewind-tiebreak-f1](v1-45-rewind-tiebreak-f1.md) — rewind tiebreak tests rely on wall-clock timing, not forced tie (0d)
 
 ## 🔵 nits (2)
 
-- [debug-process-test-no-assertions](debug-process-test-no-assertions.md) — debug-process.test.ts has no assertions (passes unconditionally) (37d)
-- [legacy-protected-removal-trigger](legacy-protected-removal-trigger.md) — Legacy 'protected' input path has no removal trigger; export still mints it (0d)
+- [debug-process-test-no-assertions](debug-process-test-no-assertions.md) — debug-process.test.ts has no assertions (passes unconditionally) (43d)
+- [legacy-protected-removal-trigger](legacy-protected-removal-trigger.md) — Legacy 'protected' input path has no removal trigger; export still mints it (6d)
 
-## ❓ questions (0)
+## ❓ questions (1)
 
-(none)
+- [v1-21-31-hygiene-f2](v1-21-31-hygiene-f2.md) — Add release-engine paragraph to ignatius CLAUDE.md (2d)

.claude/project/followups/db-transfer-no-fk-negation-collision.md

@@ -0,0 +1,24 @@
+---
+id: db-transfer-no-fk-negation-collision
+title: citty --no-fk/--no-identity never actually toggle (negation collision)
+created: "2026-07-13"
+origin: |
+    docs/spec/v1-24-polish-batch.md, iter 1 implementer+reviewer (CP-3)
+kind: finding
+severity: risk
+review_by: "2026-09-11"
+status: open
+file: src/cli/db/transfer.ts:305-306
+---
+
+citty's raw-arg parser unconditionally strips any --no-X argv token and treats
+it as negating a flag literally named X, regardless of what is declared. Two of
+`db transfer`'s boolean flags are themselves named no-fk/no-identity (now noFk/noIdentity),
+so passing --no-fk on the CLI has never set args.noFk to true -- it silently sets an
+unrelated, undeclared args.fk = false instead. disableForeignKeys: args.noFk !== true
+therefore always evaluates true regardless of the flag. Confirmed empirically both
+before and after the v1-24 camelCase rename -- behavior is byte-identical, so that
+ticket's "flag surface must not change" bar was met, but the flags have likely never
+worked as documented. Needs a dedicated fix: likely renaming away from the no- prefix
+pattern (e.g. --skip-fk-check/--skip-identity) or adding explicit non-auto-negated
+boolean parsing.

.claude/project/followups/v1-21-31-hygiene-f2.md

@@ -0,0 +1,18 @@
+---
+id: v1-21-31-hygiene-f2
+title: Add release-engine paragraph to ignatius CLAUDE.md
+created: "2026-07-12"
+origin: |
+    docs/spec/v1-21-31-hygiene.md, iter 1 implementer (CP-10)
+kind: finding
+severity: question
+review_by: "2026-09-10"
+status: open
+file: /Users/alonso/projects/noorm/ignatius/CLAUDE.md
+---
+
+Ticket 31 (document release-engine split) asks for a matching paragraph in the ignatius repo's CLAUDE.md stating release-please as its engine and why it fits (conventional-commit-derived changelog, single-package manifest -- unlike monorepo's fixed-version group, which exists to keep two coupled packages in lockstep). Not applied during v1/21-31-hygiene because ignatius is a separate git repo (/Users/alonso/projects/noorm/ignatius) with no worktree isolation or review loop inside that branch's scope.
+
+Verbatim paragraph to add to ignatius/CLAUDE.md:
+
+"Ignatius releases via release-please (conventional-commit-derived changelog, single-package manifest) -- the right fit for a single-package repo, unlike monorepo's fixed-version group which exists specifically to keep two coupled packages in lockstep."

.claude/project/followups/v1-45-rewind-tiebreak-f1.md

@@ -0,0 +1,14 @@
+---
+id: v1-45-rewind-tiebreak-f1
+title: rewind tiebreak tests rely on wall-clock timing, not forced tie
+created: "2026-07-14"
+origin: |
+    docs/spec/v1-45-rewind-tiebreak.md, iter 1 reviewer (checkpoint 1)
+kind: finding
+severity: risk
+review_by: "2026-09-12"
+status: open
+file: tests/core/change/manager.test.ts:291-316
+---
+
+tests/core/change/manager.test.ts:291-316 (new tie-specific test) and the pre-existing test at ~line 250 force an appliedAt tie by relying on two sequential manager.run() calls landing within the same wall-clock second (SQLite CURRENT_TIMESTAMP second-precision), rather than deterministically forcing equal executed_at values. In the rare case the two calls straddle a second boundary, the test would still pass (non-tied ordering is unaffected by the tiebreak fix) but would not actually exercise the new appliedHistoryId tiebreak logic for that run -- false confidence, not a false failure. Fix: force the tie deterministically, e.g. by writing two history rows with an identical executed_at value directly, or by stubbing the clock during the two run() calls in this test file specifically.

.claude/rules/tui-development.md

@@ -128,7 +128,7 @@ For fixed-position elements (like toast), use fixed width to reserve space and p
 Use hooks from `src/tui/hooks/useObserver.ts` for event subscriptions. These handle cleanup automatically.
 
 ```tsx
-import { useOnEvent, useOnceEvent, useEmit, useEventPromise } from '../hooks/index.js';
+import { useOnEvent, useOnceEvent, useEmit } from '../hooks/index.js';
 
 // Subscribe to events - cleanup on unmount
 useOnEvent('changeset:complete', (data) => {
@@ -143,10 +143,6 @@ useOnceEvent('build:complete', (data) => setFinalResult(data), []);
 // Emit events via memoized callback
 const emitStart = useEmit('build:start');
 emitStart({ schemaPath, fileCount });
-
-// Promise-based with state management
-const [result, error, pending, cancel] = useEventPromise('build:complete');
-if (pending) return <Spinner />;
 ```
 
 

.claude/rules/typescript.md

@@ -126,11 +126,13 @@ If you're going to re-throw the error unchanged in every case, skip `attempt` an
 
 ## Error Handling (ZERO TOLERANCE)
 
-- **NEVER use try-catch** - This is a critical violation
-- **ALWAYS use @logosdx/utils utilities**: `attempt`, `attemptSync`, `batch`, `circuitBreaker`, `debounce`, `throttle`, `memo`, `rateLimit`, `retry`, `withTimeout`, `ObserverEngine`, `FetchEngine`
+- **NEVER use try-catch** - This is a critical violation. The zero tolerance targets try-catch specifically, not throwing or `attempt`/`attemptSync` - see Function Structure above for when to wrap deliberately vs. let errors propagate.
+- **Mandated `@logosdx/utils` utilities**: `attempt`/`attemptSync` (the convention actually in use - 553 call sites across 175 files) and `retry` (used at `src/core/connection/factory.ts:93`). Use `attempt`/`attemptSync` per the Function Structure guidance above - only when the function does something with the error.
+- **Available in `@logosdx/utils` but not currently used**: `batch`, `circuitBreaker`, `debounce`, `throttle`, `memo`/`memoize`, `rateLimit`, `withTimeout`, `FetchEngine`. Reach for them if a real need arises; they are not mandated because nothing in `src/` imports them today.
+- `ObserverEngine` is `@logosdx/observer`, not `@logosdx/utils`.
 
 ```typescript
-// CORRECT
+// CORRECT - attempt() used deliberately: observes the error, emits, then stops
 const [result, err] = await attempt(() => db.execute(sql));
 if (err) {
 
@@ -139,6 +141,9 @@ if (err) {
     return;
 }
 
+// ALSO CORRECT - nothing to add by wrapping; let the error propagate
+return db.execute(sql);
+
 // WRONG - Never do this
 try {
     const result = await db.execute(sql);
@@ -264,7 +269,7 @@ assert(condition, 'message', CustomError);
 
 ## Class Patterns
 
-Use private fields with `#` prefix. Namespace types under the class.
+Use private fields with `#` prefix.
 
 ```typescript
 export class StateManager {
@@ -280,15 +285,6 @@ export class StateManager {
 
     }
 
-}
-
-export namespace StateManager {
-
-    export interface Config {
-        name: string;
-        connection: ConnectionConfig;
-    }
-
 }
 ```
 

.github/workflows/docs.yml

@@ -31,6 +31,9 @@ jobs:
                   bun install --frozen-lockfile
                   cd docs && bun install --frozen-lockfile
 
+            - name: Check --json doc placement
+              run: bun run lint:docs
+
             - name: Build docs
               env:
                   VITEPRESS_BASE: /

.github/workflows/publish.yml

@@ -76,10 +76,18 @@ jobs:
       - name: Build binaries
         run: bun run build:binary
 
+      - name: Generate checksums
+        working-directory: packages/cli/bin
+        run: |
+          shasum -a 256 noorm-* > checksums.txt
+          cat checksums.txt
+
       - name: Upload binaries to release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.version.outputs.tag }}
-          files: packages/cli/bin/noorm-*
+          files: |
+            packages/cli/bin/noorm-*
+            packages/cli/bin/checksums.txt
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-binary.yml

@@ -29,10 +29,18 @@ jobs:
             - name: Build binaries
               run: bun run build:binary
 
+            - name: Generate checksums
+              working-directory: packages/cli/bin
+              run: |
+                  shasum -a 256 noorm-* > checksums.txt
+                  cat checksums.txt
+
             - name: Upload binaries to release
               uses: softprops/action-gh-release@v2
               with:
                   tag_name: ${{ steps.version.outputs.tag }}
-                  files: packages/cli/bin/noorm-*
+                  files: |
+                      packages/cli/bin/noorm-*
+                      packages/cli/bin/checksums.txt
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CLAUDE.md

@@ -48,13 +48,15 @@ The integration step needs postgres/mysql/mssql reachable (CI uses service conta
 
 ## Changesets
 
-This is a pnpm monorepo with two publishable packages. Changeset frontmatter must reference the correct workspace package name:
+This is a bun workspace monorepo with two publishable packages. Changeset frontmatter must reference the correct workspace package name:
 
 - **`@noormdev/cli`** — `packages/cli` (CLI/TUI)
 - **`@noormdev/sdk`** — `packages/sdk` (programmatic SDK)
 
 Never use `noorm` or `@noormdev/main` — those are not workspace packages and will fail the Release workflow.
 
+Changesets is the release engine because it supports a fixed-version group: `@noormdev/cli` and `@noormdev/sdk` are coupled packages that always bump together on every release, which fits a two-package monorepo where the packages version in lockstep rather than independently.
+
 
 ## Tech Stack
 

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Danilo Alonso
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

TODO.md

@@ -17,101 +17,10 @@ Core SDK is implemented and packaged (`@noormdev/sdk`). Remaining:
 
 ### Headless CLI Gaps
 
-40 handlers implemented. Missing commands:
-
-**Database:**
-
-- [x] `db reset` - Teardown + build (idempotent rebuild)
-- [x] `db drop` - Drop entire database
-- [x] `db create` - Create database if not exists
-
-**Configuration:**
-
-- [x] `config validate` - Validate config can connect
-- [x] `config list` - List available configs
-
-**SQL Execution:**
-
-- [x] `sql <query>` - Execute raw SQL
-- [x] `sql -f <file>` - Execute SQL from file
-
-**Changes:**
-
-- [x] `change next` - Apply next pending change
-
-**Runner:**
-
-- [x] `run files <path...>` - Run multiple specific files
-- [x] `run exec` - Batch-execute selected SQL files (currently TUI-only `RunExecScreen`)
-
-
-### TUI Parity Gaps
-
-Surfaces that exist in the TUI but have no headless CLI equivalent. Discovered after the citty migration audit. Blocks CI/CD adoption for anything beyond `change`/`run`/`vault` workflows.
-
-**Identity:** (entire domain TUI-only — no `noorm identity` command)
-
-- [x] **CI provisioning + runtime** — full `noorm ci` namespace for CI/CD:
-    - `noorm ci identity new` — generate a local keypair + env block for test CI
-    - `noorm ci identity enroll --config <name>` — generate + register identity in a prod DB's `identities` table with vault propagation
-    - `noorm ci init` — bootstrap ephemeral state.enc from env vars (identity + connection)
-    - `noorm ci secrets --file <path>` — batch-load secrets from dotenv file into active config's vault
-    - Absorbs and removes the former `noorm identity ci` diagnostic
-- [x] `identity init` - Generate or regenerate an identity headlessly
-- [x] `identity edit` - Edit identity metadata (name, email)
-- [x] `identity export` - Export public key
-- [x] `identity list` - List known users
-
-**Init:**
-
-- [x] `noorm init` - Bootstrap a project (identity setup + project setup) from CLI
-
-**Settings:** (entire domain TUI-only — no `noorm settings` command)
-
-- [x] `settings init` - Initialize `settings.yml`
-- [x] `settings build` - Build/regenerate settings
-- [x] `settings edit` - Interactive editor. Prompts for a field to edit (paths, strict, logging, stages, rules), applies the change, then loops back to the field picker. Exits on "Done" selection or `Esc`. One command covers everything.
-- [x] `settings secret` - Interactive secret **requirement** declaration (config enforcement, not value storage). Declares that a given secret must be set for a particular stage (or all stages). Loop pattern: pick action (add/edit/rm requirement), pick scope (universal or a stage), apply, loop. Exits on "Done" or `Esc`. Actual secret values live in `secret/*` / vault.
-
-**Secrets:** (entire `secret/*` domain TUI-only — distinct from `vault`)
-
-- [x] `secret list` - List secrets
-- [x] `secret set <key> <value>` - Set a secret
-- [x] `secret rm <key>` - Remove a secret
-
-**Configuration (additional):**
-
-- [x] `config cp <src> <dest>` - Copy a config
-- [x] `config export <name>` - Export a config to file
-- [x] `config import <path>` - Import a config from file
-
-**Changes (additional):**
-
-- [x] `change add <name>` - Create a new change
-- [x] `change edit <name>` - Edit an existing change
-- [x] `change rm <name>` - Delete a change
-- [x] `change rewind <name>` - Rewind to a specific change
-- [x] `change history detail <name>` - Show per-file execution history
-
-**Database (additional):**
+All headless CLI commands are implemented except one:
 
 - [ ] `db dt-modify <path>` - Modify a `.dt` file (currently only TUI `DtModifyScreen`)
 
-**Database Exploration:**
-
-- [x] `db explore views` + `db explore views <name>` - List and inspect views
-- [x] `db explore procedures` + `db explore procedures <name>` - List and inspect stored procedures
-- [x] `db explore functions` + `db explore functions <name>` - List and inspect functions
-- [x] `db explore types` + `db explore types <name>` - List and inspect custom types
-- [x] `db explore indexes` - List indexes
-- [x] `db explore fks` - List foreign keys
-
-**SQL Terminal:** (CLI `sql` is one-shot only)
-
-- [x] `sql repl` - Interactive SQL REPL (currently TUI-only `SqlTerminalScreen`)
-- [x] `sql history` - Show SQL execution history
-- [x] `sql clear` - Clear SQL execution history
-
 
 ### CI/CD Integration
 

docs/cli/identity.md

@@ -44,7 +44,7 @@ Print your public key so teammates can add you to encrypted vaults:
 
 ```bash
 noorm identity export
-noorm --json identity export
+noorm identity export --json
 ```
 
 
@@ -54,7 +54,7 @@ Show every identity discovered from database syncs (the audit trail of who has t
 
 ```bash
 noorm identity list
-noorm --json identity list
+noorm identity list --json
 ```