Native common-auth migration and host integration

.ci/test-count-floors.json

@@ -1,17 +1,17 @@
 {
   "floors": {
-    "core": 325,
-    "opencode": 1741,
-    "pi": 155
+    "core": 1508,
+    "opencode": 2010,
+    "pi": 220
   },
   "measurement": {
-    "head": "eb10f1479ff7fb91bdfbc2ce266666a569f41db5",
+    "head": "688a8becd40c25d851116f987b55707c99f3d870",
     "dirtyPaths": 0
   },
   "evidence": {
-    "_note": "Pinned Bun 1.3.14 runner totals after the mural cache anchor fix. The clean branch commit was measured locally; clean PR CI independently matched all totals. Runner counts, not source declaration counts, are the authority at the gate.",
-    "core": "325 passing at clean branch commit eb10f147; independently matched by clean CI run 37244390451",
-    "opencode": "1741 passing at clean branch commit eb10f147; independently matched by clean CI run 37244390451",
-    "pi": "155 passing at clean branch commit eb10f147; independently matched by clean CI run 37244390451"
+    "_note": "Pinned Bun 1.3.14 unit totals measured on native cutover head 688a8bec by CI run 38161601147. The unit census passed, including disposable packed hosts; the later E2E step failed separately. Runner counts, not source declaration counts, are the authority at the gate.",
+    "core": "1508 passing at head 688a8bec; CI run 38161601147 MEASURED: core 1508",
+    "opencode": "2010 passing at head 688a8bec, including packed host cases; CI run 38161601147 MEASURED: opencode 2010",
+    "pi": "220 passing at head 688a8bec; CI run 38161601147 MEASURED: pi 220"
   }
 }

.github/workflows/ci.yml

@@ -19,11 +19,16 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
       - run: bun install --frozen-lockfile
+      - name: Install the locked OC1 config dependency fixture
+        run: npm ci --prefix packages/e2e-tests/fixtures/opencode1-config-deps --ignore-scripts --no-audit --no-fund
       - run: bun run check:workspace-lock
       - run: bun run types
       - run: bun run build
+      - run: bun test --cwd packages/opencode scripts/check-bundle-globals.test.ts
       - run: bun test scripts/check-pi-dist-imports.test.ts
       - run: bun run check:pi-dist-imports
+      - run: bun run --cwd packages/core test:scripts
+      - run: bun test scripts/tests/run-mutation-ci.test.ts scripts/tests/run-mutation-bun.test.ts
       - run: bun run check:claustrum-golden
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -34,7 +39,8 @@ jobs:
         env:
           TUI_SMOKE_SKIP_BUILD: "1"
       - run: bun run test:pi-host
-      - run: npm install -g opencode-ai@1.18.18
       - run: bun run test:e2e
+        env:
+          ANTHROPIC_AUTH_E2E_OPENCODE_CONFIG_DEPS: ${{ github.workspace }}/packages/e2e-tests/fixtures/opencode1-config-deps
       - run: bun run format:check
       - run: bun run lint

.github/workflows/mutations.yml

@@ -0,0 +1,54 @@
+name: Mutation guards
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: mutation-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  guards:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      MUTATION_EVENT: ${{ github.event_name }}
+      MUTATION_BASE: ${{ github.event.pull_request.base.sha }}
+      MUTATION_HOME: ${{ github.workspace }}/node_modules/.cache/ckdev-mutate-0.9.2
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
+      - run: bun install --frozen-lockfile
+      - name: Build shared Core for test preloads
+        run: bun run --cwd packages/core build
+      - name: Install pinned mutation runner
+        shell: bash
+        run: |
+          CARGO_HOME="$MUTATION_HOME/cargo-home" \
+          CARGO_TARGET_DIR="$MUTATION_HOME/target" \
+          cargo install --locked --git https://github.com/cortexkit/commons \
+            --rev b491012199d98b09fd167e00783df297d35a62b8 \
+            --root "$MUTATION_HOME/install" cortexkit-mutate
+          echo "$MUTATION_HOME/install/bin" >> "$GITHUB_PATH"
+      - name: Verify CI selection and report guards
+        run: bun test scripts/tests/run-mutation-ci.test.ts scripts/tests/run-mutation-bun.test.ts
+      - name: Replay mutation guards
+        run: bun scripts/run-mutation-ci.ts
+      - name: Retain reports and raw test evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mutation-${{ github.run_id }}-${{ github.run_attempt }}
+          path: tmp/mutations/
+          if-no-files-found: warn