graft: recover orphan branch rescue/orphan-3790cd96f100-feat-den-1450-add-environmentplan-v2-con onto main

.claude/CLAUDE.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.

.gemini/GEMINI.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.

.github/workflows/agents-policy.yml

@@ -0,0 +1,19 @@
+name: agents policy
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agents-policy-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    uses: zed-pkg/zed-monorepo/.github/workflows/agents-policy-reusable.yml@fb2417b1a976459e3de740f788916d3d91d3669e
+    with:
+      policy_ref: fb2417b1a976459e3de740f788916d3d91d3669e

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          components: rustfmt,clippy
+
+      - name: Format
+        run: cargo fmt --check
+
+      - name: Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --locked
+
+      - name: Doctest
+        run: cargo test --locked --doc
+
+      - name: Schemas are up to date
+        run: |
+          cargo run --locked --example generate_schemas
+          git diff --exit-code schemas/ \
+            || (echo "schemas/ is stale; run 'cargo run --locked --example generate_schemas' and commit" && exit 1)

.github/workflows/nix.yml

@@ -0,0 +1,58 @@
+name: nix
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/**
+      - examples/**
+      - schemas/**
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - agents.md
+      - README.md
+      - .github/workflows/nix.yml
+  pull_request:
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/**
+      - examples/**
+      - schemas/**
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - agents.md
+      - README.md
+      - .github/workflows/nix.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  agent-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Run pinned contract checks
+        run: nix develop --no-update-lock-file -c agent-check

.gitignore

@@ -12,3 +12,7 @@ tmp
 temp
 tmp/worktrees
 temp/worktrees
+
+# --- carried over from the grafted branch rescue/orphan-3790cd96f100-feat-den-1450-add-environmentplan-v2-con ---
+.cache/
+/target

.nix/agent-check.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export CI="${CI:-1}"
+export NO_COLOR="${NO_COLOR:-1}"
+
+repo_root="$(git rev-parse --show-toplevel)"
+cd "$repo_root"
+
+cache_root="${NIX_AGENT_CACHE_ROOT:-$repo_root/.cache/nix-agent}"
+export CARGO_HOME="${CARGO_HOME:-$cache_root/cargo}"
+export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$cache_root/target}"
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$cache_root/xdg}"
+mkdir -p "$CARGO_HOME" "$CARGO_TARGET_DIR" "$XDG_CACHE_HOME"
+
+run_stage() {
+  local stage="$1"
+  printf '\n==> agent-check stage: %s\n' "$stage"
+
+  case "$stage" in
+    preflight)
+      git diff --check
+      nixfmt --check flake.nix .nix/dev-shell.nix
+      shellcheck .nix/agent-check.sh
+      shfmt -i 2 -ci -d .nix/agent-check.sh
+      actionlint .github/workflows/*.yml
+      nix flake check --no-update-lock-file --show-trace
+      ;;
+    format)
+      cargo fmt --check
+      ;;
+    lint)
+      # Nixpkgs currently pins Rust/Clippy 1.95, whose nonminimal_bool advice
+      # conflicts with the explicit, security-auditable path rejection list.
+      # Current stable CI still runs every lint with -D warnings; only this
+      # toolchain-version-specific style lint is exempted in the pinned shell.
+      cargo clippy --locked --all-targets -- \
+        -D warnings \
+        -A clippy::nonminimal_bool
+      ;;
+    test)
+      cargo test --locked
+      cargo test --locked --doc
+      ;;
+    schemas)
+      cargo run --locked --example generate_schemas
+      git diff --exit-code -- schemas/
+      ;;
+    all)
+      local child
+      for child in preflight format lint test schemas; do
+        run_stage "$child"
+      done
+      ;;
+    *)
+      printf 'unknown agent-check stage: %s\n' "$stage" >&2
+      return 64
+      ;;
+  esac
+}
+
+case "${1:-all}" in
+  all | preflight | format | lint | test | schemas)
+    run_stage "${1:-all}"
+    ;;
+  *)
+    printf 'usage: agent-check [all|preflight|format|lint|test|schemas]\n' >&2
+    exit 64
+    ;;
+esac

.nix/dev-shell.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  agentCheck,
+  toolchain,
+}:
+pkgs.mkShell {
+  packages = toolchain ++ [ agentCheck ];
+
+  LANG = if pkgs.stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+  LC_ALL = if pkgs.stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+
+  shellHook = ''
+    export NIX_DEV_SHELL=zed-interfaces
+    export NIX_AGENT_CACHE_ROOT="''${NIX_AGENT_CACHE_ROOT:-$PWD/.cache/nix-agent}"
+    export CARGO_HOME="''${CARGO_HOME:-$NIX_AGENT_CACHE_ROOT/cargo}"
+    export CARGO_TARGET_DIR="''${CARGO_TARGET_DIR:-$NIX_AGENT_CACHE_ROOT/target}"
+    export XDG_CACHE_HOME="''${XDG_CACHE_HOME:-$NIX_AGENT_CACHE_ROOT/xdg}"
+    mkdir -p "$CARGO_HOME" "$CARGO_TARGET_DIR" "$XDG_CACHE_HOME"
+  '';
+}

.openai/AGENTS.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.