ci: remove the hub ratchet, DatabaseType gate and iOS isolation check

.claude/rules/ci.md

@@ -3,7 +3,6 @@ paths:
   - ".github/workflows/**/*"
   - ".github/actions/**/*"
   - ".github/actionlint.yaml"
-  - ".github/*baseline*"
   - "scripts/ci/**/*"
   - "apple/scripts/ci/**/*"
   - "scripts/release/**/*"
@@ -106,18 +105,15 @@ The required check names are in `AGENTS.md` (CI). Reading a red check: `.claude/
 
 - PR, push to main or `release/**`, dispatch, no path filter; Ubuntu, 15 minutes.
 - Steps, in order:
-  - actionlint, which also shellchecks every inline `run:` block;
+  - actionlint, which also shellchecks every inline `run:` block at `SHELLCHECK_OPTS=--severity=warning`;
   - `shellcheck --severity=warning` on every `*.sh` under `scripts`, `apple/scripts` and `.claude/skills`;
   - the tooling tests: `scripts/ci/test_*.py`, `apple/scripts/ci/test_*.py`, `apple/scripts/lib/test_*.py`, `apple/scripts/test_localization.py` and `apple/scripts/ci/test_libs_release.sh`;
   - `apple/scripts/release/test_*.py` on Python 3.9 from `actions/setup-python`, in a venv that installs `scripts/release/requirements.txt` with `pip --require-hashes`;
   - in the same venv, `check-changelog.py` and `towncrier build --draft --version 0.0.0` with `--dir apple` and `--dir linux`, which fails on a fragment name it cannot parse;
-  - `check-lib-sourcing.py`, `check-plugin-manifest.py`, `check-plugin-provides.py`, `check-deployment-target.sh`, `check-ios-shared-isolation.py`;
+  - `check-lib-sourcing.py`, `check-plugin-manifest.py`, `check-plugin-provides.py`, `check-deployment-target.sh`;
   - `localization.py plugins` and `plugins --target ios`;
   - `check-string-catalogs.py`, `check-license-inventory.py`, `check-entitlements.py`, `check-test-plans.py`;
-  - `apple/scripts/audit-refactor-health.sh --check`, `check-hub-ratchet.py`;
   - the Go checks on the HANA helper, `govulncheck` among them, when the `hana` detector is true. New advisories between changes arrive as Dependabot alerts.
-- `audit-refactor-health.sh --check` fails a file defining a production `DatabaseType` outside `apple/Packages/TableProCore/Sources/TableProCoreTypes/DatabaseType.swift`, unless `.github/duplicate-contract-baseline.txt` lists its path. Moving a listed file moves its baseline path in the same commit. Never add an entry to let a new copy pass.
-- `check-hub-ratchet.py` fails when an app hub grows past `.github/hub-ratchet-baseline.json`. `--update` only lowers a value, so growing one is a hand edit a reviewer sees.
 
 ## Change detector (`scripts/ci/detect-changed-paths.sh`)
 

.github/workflows/repo-hygiene.yml

@@ -34,6 +34,8 @@ jobs:
 
       # actionlint runs shellcheck over every inline run: block, which nothing else sees.
       - name: Lint workflows
+        env:
+          SHELLCHECK_OPTS: --severity=warning
         run: ./actionlint -color
 
       - name: Lint scripts
@@ -95,10 +97,6 @@ jobs:
       - name: Check no build script hardcodes the deployment target
         run: bash apple/scripts/ci/check-deployment-target.sh
 
-      # iOS alone defaults to MainActor isolation, so a shared plugin file must state its own.
-      - name: Check shared plugin sources are explicitly isolated for iOS
-        run: python3 apple/scripts/ci/check-ios-shared-isolation.py
-
       # A plugin's or package's String(localized:) resolves against the host app's bundle, so its
       # strings live in each app's catalog by hand.
       - name: Check plugin and package strings reach the string catalogs
@@ -122,12 +120,6 @@ jobs:
       - name: Check every test target is in its test plan
         run: python3 apple/scripts/ci/check-test-plans.py
 
-      - name: Check the shared-contract drift gates
-        run: apple/scripts/audit-refactor-health.sh --check
-
-      - name: Check no hub grew past its recorded size
-        run: python3 apple/scripts/ci/check-hub-ratchet.py
-
       - name: Decide whether the SAP HANA helper changed
         id: native
         env:

AGENTS.md

@@ -54,7 +54,7 @@ Claude Code loads a rule when it reads or edits a file the rule covers. Under Co
 | --- | --- |
 | `ai-mcp-security.md` | `apple/TablePro/Core/AI`, `apple/TablePro/Core/MCP`, `apple/Packages/TableProMacCore/Sources/TableProMCP` |
 | `changelog.md` | `**/CHANGELOG.md`, `**/changelog.d`, `**/towncrier.toml` |
-| `ci.md` | `.github/workflows`, `.github/actions`, `.github/actionlint.yaml`, `.github/*baseline*`, `scripts/ci`, `apple/scripts/ci`, `scripts/release`, `apple/scripts/release`, `apple/.swiftlint.yml`, `**/.swiftlint.yml` |
+| `ci.md` | `.github/workflows`, `.github/actions`, `.github/actionlint.yaml`, `scripts/ci`, `apple/scripts/ci`, `scripts/release`, `apple/scripts/release`, `apple/.swiftlint.yml`, `**/.swiftlint.yml` |
 | `connection-window.md` | `apple/TablePro/Core/Services/Infrastructure`, `apple/TablePro/Models/Connection`, `apple/TablePro/Core/Database/DatabaseManager*.swift`, `apple/Packages/TableProCore/Sources/TableProDatabase`, `apple/TablePro/Views/Main` |
 | `data-grid.md` | `apple/TablePro/Views/Results`, `apple/TablePro/Core/DataGrid`, `apple/TableProTests/Views/Results` |
 | `data-sync-storage.md` | `apple/TablePro/Core/**/*Storage*.swift`, `apple/TablePro/Core/**/*Sync*.swift`, `apple/TablePro/Core/Database`, `apple/TablePro/Core/Plugins/PluginMetadataRegistry*.swift`, `apple/TablePro/Core/Services/Query`, `apple/Packages/TableProCore/Sources/TableProSyncTransport`, `apple/CloudKit` |

apple/AGENTS.md

@@ -76,7 +76,7 @@ apple/scripts/generate-project.sh [both|macos|ios]  # needs the libs; rerun afte
 - **Storage resolves through `AppStorageEnvironment.shared`** (stores, defaults suite, keychain); the `storage_environment_*` SwiftLint rules fail other Application Support or standard-defaults use.
 - **An AppKit autosave name** (split view, window frame, table) **goes through `SplitViewAutosaveName.current(_:)`**: AppKit writes the record to the real defaults domain, which the sandbox does not redirect.
 - **No new test-only branch in production code**: tests use injection or `TABLEPRO_UI_TEST_SANDBOX`.
-- **macOS files the iOS app compiles** (listed in `TableProMobile/project.yml`) give each top-level declaration explicit isolation, usually `nonisolated`, since iOS defaults to `MainActor` (`scripts/ci/check-ios-shared-isolation.py`).
+- **macOS files the iOS app compiles** (listed in `TableProMobile/project.yml`) give each top-level declaration explicit isolation, usually `nonisolated`, since iOS defaults to `MainActor`. The iOS build is the check.
 - **No package product in a macOS binary depends on the `TableProPluginKit` package**: a plugin would carry its own PluginKit types (`.claude/rules/plugin-system.md`).
 - **A source-text rule is a SwiftLint rule or a `scripts/ci` check**, never a test reading source.
 

apple/TablePro/Core/SSH/LibSSH2ChannelIO.swift

@@ -4,7 +4,7 @@
 //
 //  Compiled into the macOS app and, by file reference, into the iOS app, which defaults to
 //  MainActor isolation. Every top-level declaration states its own isolation for that reason;
-//  scripts/ci/check-ios-shared-isolation.py holds it.
+//  the iOS build is the check.
 //
 
 import Foundation

apple/TablePro/Core/SSH/LibSSH2ForwardChannel.swift

@@ -4,7 +4,7 @@
 //
 //  Compiled into the macOS app and, by file reference, into the iOS app, which defaults to
 //  MainActor isolation. Every top-level declaration states its own isolation for that reason;
-//  scripts/ci/check-ios-shared-isolation.py holds it.
+//  the iOS build is the check.
 //
 
 import Foundation

apple/TablePro/Core/SSH/SSHKeepAliveResult.swift

@@ -4,7 +4,7 @@
 //
 //  Compiled into the macOS app and, by file reference, into the iOS app, which defaults to
 //  MainActor isolation. Every top-level declaration states its own isolation for that reason;
-//  scripts/ci/check-ios-shared-isolation.py holds it.
+//  the iOS build is the check.
 //
 
 import CLibSSH2