fix: integrate reviewed runtime and application repairs

.cargo/config.toml

@@ -31,7 +31,7 @@ CXXFLAGS_aarch64_pc_windows_msvc = { value = "-DNDEBUG /utf-8", force = false }
 # connections. Nothing reads those statistics or sets a heap limit.
 LIBSQLITE3_FLAGS = { value = "-DSQLITE_MAX_WORKER_THREADS=15 -DSQLITE_DEFAULT_MEMSTATUS=0", force = true }
 
-# Global accounting (savings ledger, worldwide-counter flushes) is ON by
+# Global accounting (the savings ledger) is ON by
 # default for installed binaries, but `cargo test` / `cargo run` would then
 # write temp-project rows into the developer's real ~/.tracedecay/global.db.
 # Keep cargo-launched processes hermetic; tests that exercise the ledger

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,7 +33,7 @@ body:
     attributes:
       label: Installation method
       options:
-        - cargo install
+        - Built from source (Bazel)
         - Homebrew (brew)
         - Scoop
         - Built from source

.github/workflows/ci.yml

@@ -205,18 +205,11 @@ jobs:
         run: |
           python3 scripts/test-check-packaged-lsp-bridge.py
           python3 scripts/test-build-mcpb.py
-          python3 scripts/test-resolve-installed-binary.py
-          python3 scripts/test-check-packaged-mcp-stdio.py
-          python3 scripts/test-check-distribution-feature-wiring.py
-          python3 scripts/test-resolve-release-source-profile.py
           python3 scripts/test-package-release-archive.py
           python3 scripts/test-plan-release-recovery.py
           python3 scripts/test-check-release-artifacts.py
           python3 scripts/test-update-release-checksums.py
           python3 scripts/test-neutralize-release-pr-closing-keywords.py
-          bash scripts/test-check-distribution-clean-source.sh
-          bash scripts/test-check-distribution-snapshot.sh
-          bash scripts/test-check-distribution-reuse.sh
           bash tests/macos_stable_codesign_test.sh
 
       # Exercise the release guard scripts when admitting proposed changes.
@@ -604,12 +597,17 @@ jobs:
       - name: Run blocking Clippy policy
         run: bazel build --config=ci --config=clippy //...
 
-      # Master pushes run no Windows lane, so `cfg(windows)` code otherwise
-      # first compiles in the release build. Bazel has no MSVC toolchain on
-      # Linux, so this cross-target type check stays on Cargo: `cargo check`
-      # needs no linker, and mingw supplies the C compiler the native build
-      # scripts run. macOS has no equivalent: its build scripts need the Apple
-      # SDK headers.
+      # The one deliberate Cargo step left in CI, and only because Bazel cannot
+      # replace it yet. Master pushes and ordinary PRs run no Windows lane
+      # (`windows-test` is dispatch-only), so `cfg(windows)` code otherwise
+      # first compiles in the release build. The workspace registers no
+      # Windows target toolchain for Linux, so this cross-target type check
+      # stays on Cargo: `cargo check` needs no linker, and mingw supplies the
+      # C compiler the native build scripts run. It type-checks only and
+      # produces no executable, so no eval, test, or release consumes its
+      # output and it cannot diverge a shipped runtime. Remove it when Bazel
+      # grows a Linux-hosted Windows target. macOS has no equivalent: its
+      # build scripts need the Apple SDK headers.
       - name: Install pinned toolchain and Windows check target
         run: |
           rustup toolchain install
@@ -619,8 +617,14 @@ jobs:
 
       - name: Install the Windows C cross-compiler
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends gcc-mingw-w64-x86-64
+          # This compiler comes from Ubuntu, independently of third-party feeds
+          # preconfigured on the hosted image.
+          ubuntu_sources=(
+            -o Dir::Etc::sourcelist=sources.list.d/ubuntu.sources
+            -o Dir::Etc::sourceparts=-
+          )
+          sudo apt-get "${ubuntu_sources[@]}" update
+          sudo apt-get "${ubuntu_sources[@]}" install -y --no-install-recommends gcc-mingw-w64-x86-64
 
       - name: Check the Windows target
         run: >-
@@ -702,6 +706,16 @@ jobs:
           archive: tar.gz
           epoch: ${{ steps.packaging.outputs.epoch }}
 
+      - name: Exercise shipped MCP and LSP transports
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary="$GITHUB_WORKSPACE/target/x86_64-unknown-linux-gnu/release/tracedecay"
+          smoke_work="$(mktemp -d)"
+          trap 'rm -rf -- "$smoke_work"' EXIT
+          TRACEDECAY_BIN="$binary" bazel run //scripts:mcp-conformance-smoke.sh
+          bazel run //scripts:packaged_lsp_bridge -- "$binary" "$smoke_work/lsp"
+
   # Frontend checks require no Rust compilation and must also validate drafts.
   # Do not serialize them behind repository-wide Rust formatting and gates.
   dashboard:

.github/workflows/hawk.yml

@@ -6,8 +6,7 @@
 # softening -D warnings.
 name: Hawk
 
-# On demand only; see distribution-acceptance.yml for why nothing runs on a
-# timer here.
+# On demand only; an optional diagnostic should run when someone will read it.
 on:
   workflow_dispatch:
 

.github/workflows/hermetic-evals.yml

@@ -5,12 +5,14 @@ on:
     paths:
       - "evals/hermetic/**"
       - "evals/agent_adoption/**"
+      - "scripts/build-eval-binary.sh"
       - ".github/workflows/hermetic-evals.yml"
   push:
     branches: [master]
     paths:
       - "evals/hermetic/**"
       - "evals/agent_adoption/**"
+      - "scripts/build-eval-binary.sh"
       - ".github/workflows/hermetic-evals.yml"
 
 permissions:
@@ -34,11 +36,13 @@ jobs:
         run: |
           bash -n evals/hermetic/run.sh
           bash -n evals/agent_adoption/run.sh
+          bash -n scripts/build-eval-binary.sh
       - name: Run scorer and shell-runner regressions
         run: >-
           bazel test
           //evals/hermetic:score_test
           //evals/hermetic:run_test
           //evals/hermetic:scorecard_test
           //evals/agent_adoption:selftest
+          //scripts:build_eval_binary_test
           --test_output=errors

BUILD.bazel

@@ -12,6 +12,7 @@ npm_link_all_packages(name = "node_modules")
 exports_files(
     [
         ".github/release-targets.json",
+        "MODULE.bazel",
         "version.txt",
         "Cargo.toml",
         "clippy.toml",

MODULE.bazel

@@ -2,6 +2,7 @@ module(name = "tracedecay", version = "0.0.0")
 
 bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.2")
+bazel_dep(name = "bazel_lib", version = "3.7.0")
 bazel_dep(name = "rules_python", version = "2.4.2")
 bazel_dep(name = "rules_rust", version = "0.74.0")
 # Rustc adds every dependency search directory to PATH on Windows; large

README.md

@@ -195,8 +195,6 @@ authorized, sanitized, classified records under their remote policy.
 
 Network-capable effects are separate from core retrieval:
 
-- Worldwide counter: when opted in, sends the pending aggregate token-savings
-  amount, and `tracedecay doctor` reads the public total to check reachability.
 - GitHub release checks and updates: contact GitHub release endpoints. An
   explicitly configured private GitHub review source can use a read-only
   credential from the operating-system keyring; missing, ambiguous,
@@ -212,19 +210,13 @@ Network-capable effects are separate from core retrieval:
   path fails closed with typed `unavailable`, `denied`, or `stale-peer` state.
 
 These services receive normal transport metadata, including the connection's
-source address, in addition to any request payload. The counter request is an
-aggregate amount, not repository content, but it is not an anonymity guarantee.
-Use a network policy or firewall if a command must make no outbound connection.
-An opt-out, denial, timeout, or unavailable remote service must remain visible
-as that state; it is not evidence of a zero counter, an up-to-date release, or
-current pricing. See [Security](SECURITY.md#network-access) for the complete
-outbound-access and credential boundary.
-
-Disable the worldwide counter with:
-
-```bash
-tracedecay disable-upload-counter
-```
+source address, in addition to any request payload. Use a network policy or
+firewall if a command must make no outbound connection. A denial, timeout, or
+unavailable remote service must remain visible as that state; it is not
+evidence of an up-to-date release or current pricing. TraceDecay no longer has
+a worldwide token counter: token savings and costs stay local. See
+[Security](SECURITY.md#network-access) for the complete outbound-access and
+credential boundary.
 
 ## Troubleshooting
 
@@ -269,9 +261,9 @@ bazel build //...
 bazel test //... --test_output=errors
 ```
 
-Use Cargo when you need to validate Cargo packaging, a feature combination that
-has no Bazel target, or a platform-specific workflow. The release workflows
-continue to build the published Cargo artifact.
+Bazel owns workspace builds, tests, checks, and code generation. Release
+workflows package its production CLI as binary archives and MCP bundles;
+Rust workspace crates are private and are not published to crates.io.
 
 On macOS `tracedecay` is ad-hoc signed as `dev.tracedecay.cli` with
 designated requirement `identifier "dev.tracedecay.cli"`. macOS TCC keys
@@ -280,14 +272,9 @@ requirement is the binary's cdhash, so an Allow does not survive the next
 rebuild; the linker default identifier (`tracedecay-<hash>`) changes every
 build as well, and the daemon blocks in `open()` until the prompt is
 answered. A release build strips after linking, which mints that identifier
-again from the deps filename. Export
-`CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER="$PWD/scripts/macos-rustc-wrapper.sh"`
-from the checkout root (the macOS CI and release jobs do) and the wrapper
-signs the product once rustc has finished, so `cargo build --release` and
-`cargo install --path crates/tracedecay-cli` keep the stable identity on
-the binary cargo copies into place. The committed Cargo config cannot set
-it, because Cargo has no per-target wrapper and Windows cannot run the
-script. `install.sh` and `tracedecay update`
+again from the deps filename. The shared release build action applies
+`scripts/macos-stable-codesign.sh` to the Bazel-built binary before packaging.
+`install.sh` and `tracedecay update`
 apply the same identity to the installed file after the archive checksum
 check when the binary is unsigned or ad-hoc signed, including an ad-hoc
 signature whose identifier already matches but whose requirement is still

SECURITY.md

@@ -67,7 +67,6 @@ Outbound capabilities include:
 | Configured remote sources and authorities | Policy-authorized retrieval and remote operations | Configured peer authentication and disclosure policy | Admission or authorization failures are reported; review each peer before enabling |
 | `github.com` | Download binary during `tracedecay upgrade` | None (public releases) | Error shown to user |
 | `huggingface.co` and Hugging Face artifact hosts | Download missing, revision-pinned semantic-model artifacts when semantic auto-download is enabled | None | Semantic retrieval reports model acquisition state or failure; exact, lexical, and graph retrieval remain available |
-| `tracedecay-counter.enzinol.workers.dev` | Aggregate token-savings counter | None | Silently ignored |
 
 Provider usage and pricing do not add an outbound connection. `tracedecay cost`
 reads immutable provider-native usage observations and the deterministic bundled
@@ -169,7 +168,6 @@ an old count of unsafe sites is not a security guarantee.
 
 The following are **not** security issues:
 
-- The aggregate token counter sending a count to the public Cloudflare Worker endpoint (this is documented behavior and contains no identifying information beyond an approximate country derived from IP by Cloudflare)
 - The database containing symbol names or file paths from your project (this is core functionality)
 - The MCP edit tools modifying files (this is opt-in functionality your AI agent invokes through its own tool-approval flow)
 - `tracedecay_run_affected_tests` compiling and running your project's own test suite (this is the tool's documented purpose)

benchmark_data/BUILD.bazel

@@ -81,4 +81,8 @@ filegroup(
 exports_files(["session-temporal/workload-v1.json"],
     visibility = ["//visibility:public"],
 )
+
+exports_files(["run_benchmarks.py"],
+    visibility = ["//evals/memory:__pkg__"],
+)
 # END generated by scripts/bazel/gen_builds.py