feat: generative detail screen, on-device NL engines, encryption at rest

.claude/settings.json

@@ -0,0 +1,31 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(./gradlew :shared:testAndroidHostTest*)",
+      "Bash(./gradlew :shared:compileAndroidHostTest*)",
+      "Bash(./gradlew :shared:iosSimulatorArm64Test*)",
+      "Bash(./gradlew :shared:compileKotlinIosSimulatorArm64*)",
+      "Bash(./gradlew :androidApp:assembleDebug*)",
+      "Bash(./gradlew :androidApp:testDebugUnitTest*)",
+      "Bash(./gradlew :core:flags:allTests*)",
+      "Bash(awk *)",
+      "Bash(curl -s *)",
+      "Bash(curl -sL *)",
+      "Bash(curl -sI *)",
+      "Bash(unzip -l *)",
+      "Bash(unzip -p *)",
+      "Bash(javap *)",
+      "Bash(xxd *)",
+      "Bash(adb devices*)",
+      "Bash(adb logcat *)",
+      "Bash(xcrun simctl list *)",
+      "mcp__claude-in-chrome__navigate",
+      "mcp__claude-in-chrome__find",
+      "mcp__claude-in-chrome__get_page_text",
+      "mcp__claude-in-chrome__read_page",
+      "mcp__claude-in-chrome__tabs_context_mcp",
+      "mcp__claude_ai_Notion__notion-fetch",
+      "mcp__claude_ai_Notion__notion-search"
+    ]
+  }
+}

.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  # A new push supersedes an in-flight run on the same ref; nobody needs the results of a commit
+  # that has already been replaced.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Everything that needs only a JVM. Split from the iOS job because this is the fast feedback most
+  # commits need, and it must not wait on a macOS runner queue.
+  shared:
+    name: Shared + Android (JVM)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - uses: gradle/actions/setup-gradle@v4
+
+      - name: Flags module
+        run: ./gradlew :core:flags:allTests --stacktrace
+
+      # verify=true makes Roborazzi compare against the committed goldens and fail on a diff. Without it
+      # the snapshot tests run, pass, and check nothing — which is how a snapshot suite quietly becomes
+      # decoration.
+      - name: Shared unit + snapshot + architecture tests
+        run: ./gradlew :shared:testAndroidHostTest -Proborazzi.test.verify=true --stacktrace
+
+      - name: Compose interaction tests
+        run: ./gradlew :androidApp:testDebugUnitTest --stacktrace
+
+      # Proves the app actually assembles with the real ML Kit and llama.cpp dependencies wired in.
+      # A green test suite over a module that no longer links is not a green build.
+      - name: Assemble debug APK
+        run: ./gradlew :androidApp:assembleDebug --stacktrace
+
+      # The baseline profile is generated on a device, which CI has none of — but the committed profile must
+      # still be packaged, and a release assemble is what proves that wiring survives.
+      - name: Assemble release (packages the committed baseline profile)
+        run: ./gradlew :androidApp:assembleRelease --stacktrace
+
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-reports
+          path: |
+            **/build/reports/tests/
+            **/build/test-results/
+            # Roborazzi writes the actual-vs-expected diff here; without it a snapshot failure on CI
+            # is unreadable and the usual response is to re-record it blind.
+            **/build/outputs/roborazzi/
+
+  # A separate job on macOS: Kotlin/Native and the Swift Tier-A bridge cannot be built anywhere else,
+  # and this is the half that a JVM-only pipeline would silently never check.
+  ios:
+    name: iOS (Kotlin/Native + Swift)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - uses: gradle/actions/setup-gradle@v4
+
+      - name: Kotlin/Native tests
+        run: ./gradlew :shared:iosSimulatorArm64Test --stacktrace
+
+      # The Swift bridge only exists in the Xcode project, so a Gradle-only iOS job would not compile
+      # FoundationModelsBridge.swift at all — and that file is where the Tier-A error mapping lives.
+      - name: Build the iOS app
+        run: |
+          xcodebuild \
+            -project iosApp/iosApp.xcodeproj \
+            -scheme iosApp \
+            -configuration Debug \
+            -destination 'generic/platform=iOS Simulator' \
+            -derivedDataPath build/dd \
+            build \
+            CODE_SIGNING_ALLOWED=NO

.gitignore

@@ -21,3 +21,13 @@ node_modules/
 # MemPalace per-project files (issue #185)
 mempalace.yaml
 entities.json
+
+# Personal write-up material — kept locally, deliberately out of the repo.
+# The three diagrams the README embeds are the exception and stay tracked.
+docs/linkedin-series.md
+docs/media/*
+!docs/media/01-before-after.png
+!docs/media/01-thesis-architecture.png
+!docs/media/05-latency-measured.png
+docs/study/
+docs/gaps.md