chore: sync main with upstream kenn-io/msgvault (aa411818)

.custom-gcl.yml

@@ -0,0 +1,5 @@
+version: v2.13.1
+plugins:
+  - module: "go.kenn.io/kit"
+    import: "go.kenn.io/kit/lint/gclplugin"
+    version: "v0.25.1-0.20260918202731-04a175847323"

.gitattributes

@@ -17,3 +17,6 @@ internal/vcard/registry/data/*.csv -text whitespace=blank-at-eol,blank-at-eof,sp
 # line endings on Windows checkouts.
 internal/slack/testdata/slackdump/standard/general/attachments/** -text
 internal/slack/testdata/slackdump/standard/__uploads/** -text
+
+# Keep the pinned upstream Vec1 source byte-for-byte reproducible.
+internal/vector/sqlitevec/vec1/vec1.c -text whitespace=-blank-at-eol,-blank-at-eof

.github/actionlint.yaml

@@ -1,3 +1,8 @@
 self-hosted-runner:
   labels:
     - windows-11-vs2026-arm
+    - namespace-profile-linux-4cpu
+    - namespace-profile-linux-8cpu
+    - namespace-profile-windows-8cpu
+    - nscloud-ubuntu-24.04-arm64-4x8
+    - namespace-profile-mac-6cpu

.github/workflows/ci-pr.yml

@@ -1,8 +1,7 @@
 name: CI
 
 # The PR dispatcher always calls the main-pinned workflow. That workflow
-# independently routes same-repository Linux jobs to the managed public fleet
-# and fork jobs to GitHub-hosted runners.
+# runs PR jobs on Namespace, including fork PRs.
 on:
   pull_request:
 

.github/workflows/codex-isolation.yml

@@ -0,0 +1,40 @@
+name: Codex isolation
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pinned-artifact:
+    # Ubuntu 22.04 permits the unprivileged user namespaces used by Bubblewrap.
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: 'true'
+      - name: Install Bubblewrap
+        run: sudo apt-get update && sudo apt-get install -y bubblewrap
+      - name: Download pinned Codex artifact
+        run: |
+          mkdir -p "$RUNNER_TEMP/codex-artifact"
+          cd "$RUNNER_TEMP/codex-artifact"
+          curl -fsSL --retry 3 https://github.com/openai/codex/releases/download/rust-v0.156.0/codex-x86_64-unknown-linux-musl.tar.gz -o codex.tar.gz
+          echo '3d49d9af25a5168cfc51e50e520ab238b23083c259ae7c14f89b007cb2545c7b  codex.tar.gz' | sha256sum -c -
+          tar -xzf codex.tar.gz
+          echo '78a11f06e0a2dda42d13fba1d50dc62e8cbdb2d5f69789722f4d4d99b5cdbe30  codex-x86_64-unknown-linux-musl' | sha256sum -c -
+          echo "MSGVAULT_CODEX_PINNED_EXECUTABLE=$PWD/codex-x86_64-unknown-linux-musl" >> "$GITHUB_ENV"
+      - name: Exercise launcher and protocol without real credentials
+        run: |
+          CGO_ENABLED=0 go build -trimpath -buildvcs=false -o "$RUNNER_TEMP/codex-artifact/msgvault-codex-bridge" ./cmd/msgvault-codex-bridge
+          chmod 755 "$RUNNER_TEMP/codex-artifact/msgvault-codex-bridge"
+          bridge_digest=$(sha256sum "$RUNNER_TEMP/codex-artifact/msgvault-codex-bridge" | cut -d' ' -f1)
+          go test -tags "fts5 sqlite_vec" -c -ldflags="-X go.kenn.io/msgvault/internal/peoplesweep.codexBridgeSHA256=$bridge_digest" -o "$RUNNER_TEMP/codex-artifact/peoplesweep.test" ./internal/peoplesweep
+          cd internal/peoplesweep
+          MSGVAULT_CODEX_TEST_DEFAULT_BRIDGE=1 "$RUNNER_TEMP/codex-artifact/peoplesweep.test" -test.timeout=5m -test.run='^TestCodex' -test.count=1

.github/workflows/docker-pr.yml

@@ -1,8 +1,6 @@
 name: Docker
 
-# Bootstrap the split between validation and publishing on a GitHub-hosted
-# runner. Follow-up PRs can return this dispatcher to docker.yml@main once
-# that read-only reusable workflow is present on the default branch.
+# Run the main-pinned build and smoke checks on Namespace.
 on:
   pull_request:
     paths:
@@ -25,36 +23,4 @@ permissions: read-all
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.3.14
-
-      - name: Build browser application
-        run: make web-assets-check
-
-      - name: Build amd64 image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          platforms: linux/amd64
-          push: false
-          load: true
-          tags: msgvault:test
-          build-args: |
-            VERSION=test
-            COMMIT=${{ github.sha }}
-            BUILD_DATE=test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Smoke test (amd64)
-        run: scripts/smoke-container.sh msgvault:test
+    uses: kenn-io/msgvault/.github/workflows/docker.yml@main

.github/workflows/docker.yml

@@ -1,14 +1,15 @@
 name: Docker
 
 on:
+  workflow_dispatch:
   workflow_call:
 
 permissions: read-all
 
 jobs:
   # PR validation: build and smoke-test only, no registry access
   validate:
-    runs-on: ${{ github.repository == 'kenn-io/msgvault' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
+    runs-on: namespace-profile-linux-4cpu
     permissions:
       contents: read
 

.github/workflows/docs.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   docs:
-    runs-on: ubuntu-24.04
+    runs-on: namespace-profile-linux-4cpu
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 

.github/workflows/workflow-validation.yml

@@ -1,6 +1,7 @@
 name: Workflow validation
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - ".github/workflows/**"
@@ -10,7 +11,7 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: namespace-profile-linux-4cpu
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0

.gitignore

@@ -1,5 +1,6 @@
 # Go binaries
 /msgvault
+/msgvault-codex-bridge
 /msgvault.exe
 /mimeshootout
 

.golangci.yml

@@ -59,6 +59,7 @@ linters:
     - ineffassign
     - intrange
     - iotamixing
+    - kennlint
     - loggercheck
     - makezero
     - mirror
@@ -203,8 +204,30 @@ linters:
         # use errors.Is to distinguish, which wrapping would break.
         - .Err(
 
+    custom:
+      # Kit's analyzers, built into custom-gcl by `make lint`. Only sleeptest
+      # runs. The stock sqlclosecheck and rowserrcheck above stay; Kit's
+      # copies and its other analyzers are off until they get their own pass.
+      kennlint:
+        type: module
+        description: Kit sleeptest, time.Sleep in tests outside synctest.
+        original-url: go.kenn.io/kit/lint
+        settings:
+          disable:
+            - errtext
+            - nohttpmux
+            - rowserrcheck
+            - sqlcheck
+            - sqlclosecheck
+            - testifyhelper
+
   exclusions:
     rules:
+      # Workspace varies in Linux enrollment tests excluded from Windows builds.
+      - linters: [unparam]
+        path: internal/peoplesweep/codex_app_server_test\.go
+        text: "syntheticCodexAuth - workspace"
+
       # Tests legitimately repeat fixture strings
       - linters: [goconst]
         path: _test\.go

.roborev.toml

@@ -54,4 +54,8 @@ repo-ignored local credential files, dotenv files, OAuth client JSON, or
 other dotfiles into those artifacts. Do not flag literal example strings in
 documentation snippets as leaked secrets unless they are plausible real
 credentials.
+
+The Jev adapter passes a plain http.Client to Docbank's TypeSafe client,
+which refuses redirects on its own copy. Do not flag redirect handling
+in internal/vector/rerank/jev.go.
 """

Dockerfile

@@ -11,7 +11,7 @@ RUN cd web && bun run generate && bun run build
 
 # Go build stage.
 # Pin by digest for reproducibility; update periodically.
-FROM golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466 AS builder
+FROM golang:1.27.1-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 AS builder
 
 # Install build dependencies for CGO (SQLite, DuckDB).
 # libsqlite3-dev provides sqlite3.h, required to compile the sqlite-vec
@@ -26,6 +26,9 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
 
 WORKDIR /src
 
+# Fall back to the module's source repo on any proxy error, not just 404/410.
+ENV GOPROXY=https://proxy.golang.org|direct
+
 # Download dependencies first (layer caching)
 COPY go.mod go.sum ./
 RUN go mod download
@@ -42,13 +45,17 @@ ARG COMMIT=unknown
 ARG BUILD_DATE=unknown
 
 # Note: Module path must match go.mod (go.kenn.io/msgvault)
-RUN CGO_ENABLED=1 go build \
+RUN CGO_ENABLED=0 go build -trimpath -buildvcs=false \
+        -o /msgvault-codex-bridge ./cmd/msgvault-codex-bridge \
+    && bridge_digest=$(sha256sum /msgvault-codex-bridge | cut -d' ' -f1) \
+    && CGO_ENABLED=1 go build \
     -tags "fts5 sqlite_vec" \
     -trimpath \
     -ldflags="-s -w \
         -X go.kenn.io/msgvault/cmd/msgvault/cmd.Version=${VERSION} \
         -X go.kenn.io/msgvault/cmd/msgvault/cmd.Commit=${COMMIT} \
-        -X go.kenn.io/msgvault/cmd/msgvault/cmd.BuildDate=${BUILD_DATE}" \
+        -X go.kenn.io/msgvault/cmd/msgvault/cmd.BuildDate=${BUILD_DATE} \
+        -X go.kenn.io/msgvault/internal/peoplesweep.codexBridgeSHA256=${bridge_digest}" \
     -o /msgvault \
     ./cmd/msgvault
 
@@ -61,6 +68,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
     tzdata \
     wget \
     libstdc++6 \
+    bubblewrap \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user
@@ -69,6 +77,7 @@ RUN groupadd --gid 1000 msgvault \
 
 # Copy binary from builder
 COPY --from=builder /msgvault /usr/local/bin/msgvault
+COPY --from=builder --chown=msgvault:msgvault /msgvault-codex-bridge /usr/local/bin/msgvault-codex-bridge
 
 # Set up data directory with correct ownership
 ENV MSGVAULT_HOME=/data