feat: Epic 13 (Structured Questions) + Epic 14 (Native STT)

.env.example

@@ -0,0 +1,11 @@
+# TalkTerm Environment Configuration
+# Copy this file to .env and fill in your values
+
+# Required for E2E tests (Claude Agent SDK)
+ANTHROPIC_API_KEY=
+
+# Test environment (local | ci)
+TEST_ENV=local
+
+# Electron user data directory override (for test isolation)
+# ELECTRON_USER_DATA_DIR=

.gitattributes

@@ -0,0 +1,2 @@
+# Normalize line endings to LF on all platforms
+* text=auto eol=lf

.github/dependabot.yml

@@ -1,19 +1,19 @@
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     open-pull-requests-limit: 0
     labels:
-      - "security"
-      - "dependencies"
+      - 'security'
+      - 'dependencies'
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
     open-pull-requests-limit: 10
     labels:
-      - "security"
-      - "dependencies"
+      - 'security'
+      - 'dependencies'

.github/labels.yml

@@ -3,29 +3,29 @@
 # https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#labels--standard-set
 
 - name: security
-  color: "d93f0b"
+  color: 'd93f0b'
   description: Security-related PRs and issues
 
 - name: dependencies
-  color: "0075ca"
+  color: '0075ca'
   description: Dependency update PRs
 
 - name: scorecard
-  color: "d93f0b"
+  color: 'd93f0b'
   description: OpenSSF Scorecard findings (auto-created)
 
 - name: bug
-  color: "d73a4a"
+  color: 'd73a4a'
   description: Bug reports
 
 - name: enhancement
-  color: "a2eeef"
+  color: 'a2eeef'
   description: Feature requests
 
 - name: documentation
-  color: "0075ca"
+  color: '0075ca'
   description: Documentation changes
 
 - name: in-progress
-  color: "fbca04"
+  color: 'fbca04'
   description: An agent is actively working this issue

.github/workflows/add-to-project.yml

@@ -47,7 +47,7 @@ jobs:
   add-to-project:
     permissions:
       contents: read
-    uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref
     with:
       project_id: PVT_kwDOD2inqs4BZq3-
       project_url: https://github.com/orgs/petry-projects/projects/1

.github/workflows/agent-shield.yml

@@ -30,4 +30,4 @@ permissions:
 
 jobs:
   agent-shield:
-    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref

.github/workflows/auto-rebase.yml

@@ -48,7 +48,7 @@ permissions: {}
 jobs:
   auto-rebase:
     permissions:
-      contents: write      # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
+      contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
       pull-requests: write # post comments on PRs
-    uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/ci-failure-analyst.yml

@@ -18,21 +18,21 @@
 # Docs: https://github.com/petry-projects/.github-private/blob/main/docs/aw/ci-failure-analyst.md
 # ─────────────────────────────────────────────────────────────────────────────
 
-name: "CI Failure Analyst"
+name: 'CI Failure Analyst'
 
 on:
   check_run:
     types: [completed]
 
 permissions:
   pull-requests: write
-  issues: write        # post/read PR comments via the Issues comments API
+  issues: write # post/read PR comments via the Issues comments API
   actions: read
   contents: read
   checks: read
 
 concurrency:
-  group: "ci-failure-analyst-${{ github.event.check_run.head_sha }}"
+  group: 'ci-failure-analyst-${{ github.event.check_run.head_sha }}'
   cancel-in-progress: false
 
 jobs:
@@ -41,6 +41,6 @@ jobs:
     if: >-
       github.event.check_run.conclusion == 'failure' &&
       !startsWith(github.event.check_run.name, 'CI Failure Analyst')
-    uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
-      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/ci.yml

@@ -33,6 +33,71 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  quality:
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci --legacy-peer-deps --ignore-scripts
+      - run: npm rebuild better-sqlite3
+      - run: npm run typecheck
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm test
+      - run: npm run test:coverage
+
+  mutation:
+    needs: quality
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci --legacy-peer-deps --ignore-scripts
+      - run: npm rebuild better-sqlite3
+      - run: npm run test:mutate
+
+  e2e:
+    needs: quality
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci --legacy-peer-deps # NOSONAR - Electron binary download and native module compilation require lifecycle scripts
+      - run: npm run make
+      - run: npm run playwright:install
+      - run: npm run test:e2e:electron
+        env:
+          CI: 'true'
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: failure()
+        with:
+          name: e2e-artifacts
+          path: |
+            test-results/
+            playwright-report/
+          retention-days: 30
+
   secret-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest

.github/workflows/copilot-setup-steps.yml

@@ -35,7 +35,7 @@
 # STACK: Node.js / npm (TypeScript + Electron desktop app)
 # ─────────────────────────────────────────────────────────────────────────────
 
-name: "Copilot Setup Steps"
+name: 'Copilot Setup Steps'
 
 on:
   workflow_dispatch:
@@ -74,7 +74,7 @@ jobs:
         # and would fail until that file is committed. Re-enable once the npm project is initialised.
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: '24'
 
       - name: Install Node.js dependencies
         # npm ci requires a package-lock.json — skip gracefully until one is committed.

.github/workflows/dependabot-automerge.yml

@@ -35,5 +35,5 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/dependabot-rebase.yml

@@ -48,9 +48,9 @@ permissions: {}
 jobs:
   dependabot-rebase:
     permissions:
-      contents: write   # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
-      pull-requests: write  # re-approve PRs after branch update
-    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+      contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
+      pull-requests: write # re-approve PRs after branch update
+    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
       APP_ID: ${{ secrets.APP_ID }}
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/dependency-audit.yml

@@ -30,4 +30,4 @@ permissions:
 
 jobs:
   dependency-audit:
-    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref

.github/workflows/dev-lead.yml

@@ -61,10 +61,10 @@ jobs:
     # dependency). Promotion is done by moving the dev-lead/v1-stable tag centrally; this
     # caller is never edited on release. agent_ref threads the same channel into
     # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent.
-    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
     with:
       agent_ref: dev-lead/v1-ring1
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable
     permissions:
       contents: write
       pull-requests: write

.github/workflows/feature-ideation.yml

@@ -65,7 +65,7 @@ on:
         default: false
         type: boolean
       enhance_backlog:
-        description: 'Backlog enhancement sweep: enhance this repo''s open, human-authored, not-yet-enhanced Ideas (one comment each, idempotent). Combine with dry_run=true to preview.'
+        description: "Backlog enhancement sweep: enhance this repo's open, human-authored, not-yet-enhanced Ideas (one comment each, idempotent). Combine with dry_run=true to preview."
         required: false
         default: false
         type: boolean
@@ -187,7 +187,7 @@ jobs:
       discussions: write
       id-token: write
       actions: read
-    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/v1-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/v1-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
     with:
       # All values below come from `needs.prep.outputs.*` (resolved in the `prep`
       # job) — NOT the `inputs` context — so this reusable `with:` compiles on the

.github/workflows/idea-triage.yml

@@ -42,5 +42,5 @@ permissions: {}
 
 jobs:
   idea-triage:
-    uses: petry-projects/.github/.github/workflows/idea-triage-reusable.yml@idea-triage/v1-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    uses: petry-projects/.github/.github/workflows/idea-triage-reusable.yml@idea-triage/v1-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/initiative-driver.yml

@@ -46,7 +46,7 @@ on:
     #          (the job below filters to that label).
     types: [closed, labeled]
   schedule:
-    - cron: "41 3 * * *" # off-peak safety net for missed close events
+    - cron: '41 3 * * *' # off-peak safety net for missed close events
   workflow_dispatch:
 
 permissions:

.github/workflows/initiative-planner.yml

@@ -44,5 +44,5 @@ permissions: {}
 
 jobs:
   initiative-planner:
-    uses: petry-projects/.github/.github/workflows/initiative-planner-reusable.yml@initiative-planner/v1-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    uses: petry-projects/.github/.github/workflows/initiative-planner-reusable.yml@initiative-planner/v1-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/pr-auto-review.yml

@@ -30,7 +30,7 @@ on:
   # to catch CI turning green on a PR.
   # "CI" is TalkTerm's CI workflow name (see .github/workflows/ci.yml).
   workflow_run:
-    workflows: ["CI"]
+    workflows: ['CI']
     types: [completed]
   # check_suite covers third-party CI checks (e.g. SonarCloud, external apps).
   check_suite:
@@ -50,6 +50,6 @@ jobs:
       pull-requests: read
       checks: read
       actions: read
-    uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
       GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}

.github/workflows/pr-review-mention.yml

@@ -37,5 +37,5 @@ jobs:
   pr-review-mention:
     permissions:
       pull-requests: write
-    uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/v2-ring1  # NOSONAR(githubactions:S7637) first-party channel ref
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/v2-ring1 # NOSONAR(githubactions:S7637) first-party channel ref
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable

.github/workflows/pr-review.yml

@@ -35,18 +35,18 @@ on:
   workflow_dispatch:
     inputs:
       pr_url:
-        description: "Optional: review a single PR URL instead of enumerating"
+        description: 'Optional: review a single PR URL instead of enumerating'
         required: false
         type: string
       dry_run:
-        description: "If true, never submit reviews or comments"
+        description: 'If true, never submit reviews or comments'
         required: false
-        default: "false"
+        default: 'false'
         type: string
       force_review:
-        description: "If true, bypass idempotency and re-review at the same head SHA"
+        description: 'If true, bypass idempotency and re-review at the same head SHA'
         required: false
-        default: "false"
+        default: 'false'
         type: string
   repository_dispatch:
     types: [pr-review-mention]
@@ -78,10 +78,10 @@ jobs:
       contents: read
       pull-requests: write
       checks: read
-    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable # NOSONAR(githubactions:S7637) first-party channel ref
     with:
       agent_ref: pr-review/stable
       pr_url: ${{ inputs.pr_url || '' }}
       dry_run: ${{ inputs.dry_run || '' }}
       force_review: ${{ inputs.force_review || '' }}
-    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable
+    secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable