Add issue reporting and verified release tracking

.github/workflows/release.yml

@@ -57,6 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.guard.outputs.commit }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Promote checked artifacts from that exact CI run
         env:

README.md

@@ -102,3 +102,8 @@ State lives under `$XDG_DATA_HOME/code-factory` or `~/.local/share/code-factory`
 The Go SDK handles MCP `2026-07-28` and legacy `2025-11-25`/`2025-06-18` tools/resources. Events extends discovery and adds custom methods without coupling the domain to Work. Legacy compatibility does not constitute a delivered Claude plugin. Claude Channels and desktop packaging are later adapters.
 
 See [operations.md](docs/operations.md) for setup, daily use, diagnostics, upgrade, recovery and uninstall. See [acceptance.md](docs/acceptance.md) for the real-host release gate and [DESIGN.md](DESIGN.md) for invariants and recovery behavior.
+
+Suspected Code Factory defects can be submitted through the bundled
+`code-factory-report-issue` skill and followed in **Reported issues**. The private
+ledger, automatic investigation/filing prerequisites, recovery and verified
+release tracking are described in [issue reporting](docs/reporting.md).

cmd/code-factory/main.go

@@ -8,6 +8,7 @@ import (
 	"codefactory/internal/events"
 	"codefactory/internal/gateway"
 	"codefactory/internal/providers"
+	"codefactory/internal/reports"
 	"codefactory/internal/setup"
 	"codefactory/internal/store"
 	"codefactory/internal/transport"
@@ -221,6 +222,10 @@ func run() error {
 		}
 		return result
 	}
+	if command == "report-publish" {
+		service := &reports.Service{Store: s, Vault: vault, Dir: *dir, GitHub: &reports.GitHubAdapter{Client: providers.NewGitHub(), Store: s}}
+		return service.PublishReport(ctx, *tunnelID)
+	}
 	if command != "serve" {
 		return fmt.Errorf("unknown command %s", command)
 	}
@@ -233,6 +238,19 @@ func run() error {
 	if e = a.Init(ctx); e != nil {
 		return e
 	}
+	executable, e := os.Executable()
+	if e != nil {
+		return e
+	}
+	a.Reports.PublishCommand = func(ctx context.Context, id string) error {
+		ctx, cancel := context.WithTimeout(ctx, 45*time.Second)
+		defer cancel()
+		cmd := exec.CommandContext(ctx, executable, "report-publish", "--data-dir", *dir, "--id", id)
+		if err := cmd.Run(); err != nil {
+			return fmt.Errorf("report publication command interrupted; retained intent will be reconciled")
+		}
+		return nil
+	}
 	if e = a.Runs.Recover(ctx); e != nil {
 		return e
 	}
@@ -249,7 +267,7 @@ func run() error {
 	})
 	httpServer := &http.Server{Addr: *address, Handler: mux, ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 16 << 10}
 	var wg sync.WaitGroup
-	for _, loop := range []func(context.Context){a.SyncLoop, a.AssessmentLoop, ev.Loop} {
+	for _, loop := range []func(context.Context){a.SyncLoop, a.AssessmentLoop, a.Reports.Loop, ev.Loop} {
 		wg.Add(1)
 		go func(loop func(context.Context)) { defer wg.Done(); loop(ctx) }(loop)
 	}

docs/ci.md

@@ -31,6 +31,13 @@ decisions. Every later revision uses the ordinary fail-closed specification gate
 The original fourteen-flow historical adoption pin remains unchanged and is not a
 public CI bypass; its private historical commit is not published.
 
+Concurrent local checkouts can set `CODE_FACTORY_TEST_UI_PORT` and
+`CODE_FACTORY_TEST_HOST_PORT` for fixture listeners, for example
+`CODE_FACTORY_TEST_UI_PORT=43173 CODE_FACTORY_TEST_HOST_PORT=43174 make ci FLOW_BASE=main`.
+Defaults remain 4173 and 4174. Both listeners stay on loopback; strict port
+ownership, fresh servers, health checks and direct-connection assertions use the
+selected ports. Installed service routes are unchanged.
+
 ## Delivery
 
 [Release](https://github.com/dk-code-factory/code-factory-plugin/actions/workflows/release.yml)
@@ -50,3 +57,10 @@ needed. CI artifacts expire after30days; rerun their original CI run if necessar
 Deployment to an operator's Linux machine remains manual. No workflow installs
 services, changes Tailscale, signs into providers, starts agents or runs live-host
 acceptance. A green build does not establish that an installation is ready.
+
+The checked CI manifest also identifies daemon and plugin component versions
+from the promoted package bytes. Explicit fixed issues in
+`release/fixed-issues.json` must name full ancestor fix commits with matching
+fixing/closing issue references. Report delivery tracking verifies the published
+release, uploaded asset digests, tag commit, checksum list and component ancestry;
+a tag, closed issue or merged PR alone does not establish release availability.