[architectureman]

Summary

Comprehensive v0.2.2 hardening, CLI upgrade, native Model Context Protocol (MCP) server, release packaging, and documentation/skills synchronization across all layers of ColimaUI:

1. Security, Async Performance & Backend/Frontend Parity (P0 + P1)

• Secret Redaction: Redact sensitive keys (/api_key|token|secret|password/i) in the SAFE ai-config-status AI event so plaintext credentials never enter LLM context or chat history.
• Port-Forward Termination Hardening: Scope k8s_pf_stop / api_k8s_port_forward_stop fallback strictly to lsof -a -c kubectl -iTCP:<port> -sTCP:LISTEN -t (with self-PID guard), enforce is_valid_k8s_name across HTTP K8s/Kind routes to prevent leading-- option injection, and set .kill_on_drop(true) on kubectl logs -f SSE streams.
• Async Worker Unblocking: Offload list_instances_fast(), limactl, and kubectl subprocess calls to run_blocking / spawn_blocking, skip 2s SSE instance polling when no instances-update subscribers exist, and add a 10s TTL cache on check_k3s_via_kubectl.
• XDG 0.10.x & $LIMA_HOME Parity: Honor custom $XDG_CONFIG_HOME in resolve_colima_home, route collect_diagnostic_logs and running_containerd_profiles through path_util::lima_home(), and honor $LIMA_HOME in standalone Lima PTY sessions.
• Container PTY & Registry Tag Fixes: Make SessionKind::DockerExec runtime-aware (docker, podman, colima nerdctl), stop 16ms PTY flush threads & release MAX_SESSIONS slots on exit, report idle-reaped sessions cleanly, and preserve :port registry prefixes in docker_state::map_images.
• Desktop/Browser Transport Parity: Fix client.ts (if (isTauri() && tauriCmd)) so Activity → History works in Desktop mode; normalize K8s IPC/HTTP item shapes for Terminal.svelte and Dashboard.svelte; fix XRay.svelte listable resource queries & reactive namespace updates; register missing HTTP parity routes (/api/instances/create-worker, /api/system/resource-saver, /api/system/runtime, /api/presets*); validate [NAVIGATE: ...] against the 17 canonical routes; update Settings.svelte to render v{__APP_VERSION__}; and complete 4-locale i18n parity (1,138 keys).

2. Real cui Headless AI Agent, Fixed colimaui CLI & Native MCP Server (cui mcp)

• Real Multi-Turn agent_loop.rs: Connect POST /api/cli/chat and cui to ai_chat::ai_chat backed by SQLite app_settings (~/.colima-ui/knowledge.db), with automatic SAFE queries and --yes (allow_actions) gating for mutations.
• Native MCP Stdio Server (src-tauri/src/mcp.rs): Expose 15 typed JSON-RPC 2.0 MCP tools via cui mcp / colimaui mcp (auto-detecting JSON-line and Content-Length framing, proxying through the Desktop HTTP API when running and falling back natively to colima_ui_lib when closed).
• colimaui Fixes: Fix multi-byte UTF-8 truncation panic, preserve existing colima.yaml on colimaui vm start unless flags are explicitly passed, run docker image prune -f on image prune, extend image pull timeout to 300s, implement container stats, adopt login shell env, and exit 1 on errors.

3. CI/CD & Documentation / AI Skills Sync

• CI & Releases (v0.2.2): Run Rust unit, CLI binary, and integration tests on both Linux x86_64 and macOS ARM64 in ci.yml, and build/upload standalone cui-*.tar.gz and colimaui-*.tar.gz archives across all 3 release targets in release.yml.
• 100% Docs & Skills Sync: Synchronize README.md, docs/*.md, src-tauri/resources/**, .agents/skills/colima-manager/SKILL.md, and external_skill/** (6 canonical ai_provider IDs, 100 App Events, 17 navigable UI pages including environment, exact SSE topic names docker-state-updated / instances-update, sandbox-safe reference commands, and MCP host setup snippets).

[ecc-tools]

ECC Tools / Security Evidence

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 126 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

PR taxonomy review recommended (neutral)

Detected 7 PR taxonomy bucket(s): Security Evidence, Harness Drift, Install Manifest Integrity, CI/CD Recommendation, Cost/Token Risk, Reference Set Validation, Agent Config Review.

Scanned 126 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

• Auth or permission changes may ship without security regression coverage
• 3 security-sensitive path(s) changed

Paths:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• src-tauri/src/auth.rs

Harness Drift

Harness-facing changes can drift across Claude Code, Codex, OpenCode, and shared adapter surfaces.

Signals:

• Harness config changes may ship without compatibility evidence
• 1 harness-facing path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

• 2 install or manifest path(s) changed

Paths:

• package-lock.json
• package.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• API contract changes may ship without integration coverage
• API implementation changes may ship without contract artifact updates
• Runtime config changes may ship without example or template updates
• User-facing UI changes may ship without browser coverage
• CI workflow changes may ship without failure-mode evidence
• 13 CI or workflow path(s) changed

Paths:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• package-lock.json
• package.json
• src/components/ai/AiModelQuickBar.test.ts
• src/components/ai/CodeBlock.test.ts
• src/lib/aiEvents/config.test.ts
• src/lib/api/client.test.ts

Cost/Token Risk

AI routing, usage, and token-budget changes should include budget or usage-limit evidence.

Signals:

• 4 cost/token path(s) changed

Paths:

• src/components/ai/AiModelQuickBar.svelte
• src/components/ai/AiModelQuickBar.test.ts
• src/components/ai/CodeBlock.svelte
• src/components/ai/CodeBlock.test.ts

Reference Set Validation

AI, analyzer, skill, agent, command, and harness guidance changes should be compared against a maintained eval, golden trace, benchmark, or reference set.

Signals:

• AI or harness analysis changes may ship without reference-set validation
• 1 reference-sensitive path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Agent Config Review

Agent, command, skill, MCP, and local instruction changes should be reviewed as executable agent configuration.

Signals:

• 1 agent-config path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

Reference set readiness gaps detected (neutral)

Reference evidence present for 2/7 areas (29%) across 126 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Present	.agents/skills/colima-manager/SKILL.md
Security evidence	Present	src-tauri/resources/skills/colima/references/security_socket.md
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 126 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Config Audit

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

Changed-config issues require attention (action_required)

Scanned 3 config file(s) present at this commit across 3 changed config path(s) and found 4 issue(s).

Changed config files:

• .agents/skills/colima-manager/SKILL.md
• .github/workflows/ci.yml
• .github/workflows/release.yml

Top findings:

• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Harness Audit

Commit: 22166ae40e23061be97f9a4ad80401ce8c342ec5

Harness warnings detected (neutral)

Scanned 3 changed config file(s) and found 1 harness issue(s).

• [medium] ECC manifest missing (.agents/skills/colima-manager/SKILL.md)

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Security Evidence

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 126 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

PR taxonomy review recommended (neutral)

Detected 7 PR taxonomy bucket(s): Security Evidence, Harness Drift, Install Manifest Integrity, CI/CD Recommendation, Cost/Token Risk, Reference Set Validation, Agent Config Review.

Scanned 126 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

• Auth or permission changes may ship without security regression coverage
• 3 security-sensitive path(s) changed

Paths:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• src-tauri/src/auth.rs

Harness Drift

Harness-facing changes can drift across Claude Code, Codex, OpenCode, and shared adapter surfaces.

Signals:

• Harness config changes may ship without compatibility evidence
• 1 harness-facing path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

• 2 install or manifest path(s) changed

Paths:

• package-lock.json
• package.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• API contract changes may ship without integration coverage
• API implementation changes may ship without contract artifact updates
• Runtime config changes may ship without example or template updates
• User-facing UI changes may ship without browser coverage
• CI workflow changes may ship without failure-mode evidence
• 13 CI or workflow path(s) changed

Paths:

• .github/workflows/ci.yml
• .github/workflows/release.yml
• package-lock.json
• package.json
• src/components/ai/AiModelQuickBar.test.ts
• src/components/ai/CodeBlock.test.ts
• src/lib/aiEvents/config.test.ts
• src/lib/api/client.test.ts

Cost/Token Risk

AI routing, usage, and token-budget changes should include budget or usage-limit evidence.

Signals:

• 4 cost/token path(s) changed

Paths:

• src/components/ai/AiModelQuickBar.svelte
• src/components/ai/AiModelQuickBar.test.ts
• src/components/ai/CodeBlock.svelte
• src/components/ai/CodeBlock.test.ts

Reference Set Validation

AI, analyzer, skill, agent, command, and harness guidance changes should be compared against a maintained eval, golden trace, benchmark, or reference set.

Signals:

• AI or harness analysis changes may ship without reference-set validation
• 1 reference-sensitive path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Agent Config Review

Agent, command, skill, MCP, and local instruction changes should be reviewed as executable agent configuration.

Signals:

• 1 agent-config path(s) changed

Paths:

• .agents/skills/colima-manager/SKILL.md

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

Reference set readiness gaps detected (neutral)

Reference evidence present for 2/7 areas (29%) across 126 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Present	.agents/skills/colima-manager/SKILL.md
Security evidence	Present	src-tauri/resources/skills/colima/references/security_socket.md
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 126 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Config Audit

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

Changed-config issues require attention (action_required)

Scanned 3 config file(s) present at this commit across 3 changed config path(s) and found 4 issue(s).

Changed config files:

• .agents/skills/colima-manager/SKILL.md
• .github/workflows/ci.yml
• .github/workflows/release.yml

Top findings:

• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)
• [high] Environment variable with secret exposed (.github/workflows/release.yml)

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Harness Audit

Commit: b030c118879c50708ddce18eeb22d88cf80cad82

Harness warnings detected (neutral)

Scanned 3 changed config file(s) and found 1 harness issue(s).

• [medium] ECC manifest missing (.agents/skills/colima-manager/SKILL.md)

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.