feat: release native transparent session filesystem preview

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+* @jstar0
+
+/docs/superpowers/specs/ @jstar0
+/internal/fold/ @jstar0
+/internal/pack/ @jstar0
+/internal/storage/ @jstar0
+/internal/vfs/ @jstar0
+/platform/darwin/fskit/ @jstar0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,58 @@
+name: Bug report
+description: Report a reproducible CodexFold defect using synthetic or redacted data.
+title: "bug: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not attach real Codex rollouts, databases, credentials, private prompts, or unredacted logs. Use GitHub Security Advisories for vulnerabilities.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: v0.2.1 or commit SHA
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - macOS
+        - Linux
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+      description: Include the command, sanitized error, and whether storage-only or filesystem-preview behavior was involved.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Synthetic reproduction
+      description: Provide minimal steps using generated or redacted fixtures.
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Verification already attempted
+      description: List doctor, tests, hashes, restart checks, or rollback attempts without private data.
+  - type: checkboxes
+    id: hygiene
+    attributes:
+      label: Data hygiene
+      options:
+        - label: I removed real session content, credentials, private prompts, local paths, and unredacted logs.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/samekind/codexfold/security/advisories/new
+    about: Report vulnerabilities and sensitive findings privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Propose a product behavior or engineering improvement.
+title: "feat: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the concrete workflow or limitation, not only the proposed implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Required outcome
+      description: State observable acceptance criteria.
+    validations:
+      required: true
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Safety and compatibility constraints
+      description: Note byte identity, rollback, privacy, platform, performance, or release-gate implications.
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Include simpler options and why they are insufficient.

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Outcome
+
+Describe the user-visible or maintainer-visible result.
+
+## Safety Impact
+
+Describe effects on session bytes, routing, storage, filesystem behavior, service lifecycle, compatibility, and rollback. Write `None` only when none apply.
+
+## Verification
+
+List the exact commands and real environments used. Distinguish unit, synthetic, mounted-adapter, real-client, restart, and production evidence.
+
+## Checklist
+
+- [ ] The change matches the product contract and does not weaken a release gate.
+- [ ] Tests cover the behavior or regression.
+- [ ] `go test ./...`, race tests, vet, formatting, and required cross-builds pass.
+- [ ] Platform-specific validation was run when platform code changed.
+- [ ] Documentation and readiness language match the available evidence.
+- [ ] No real rollout, credential, private prompt, local path, database, log, build artifact, or Xcode user state is included.
+- [ ] Production Codex data and production service definitions were not used for development validation.

.github/workflows/ci.yml

@@ -4,21 +4,108 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  quality:
+    name: quality
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Check formatting
+        shell: bash
+        run: |
+          files="$(gofmt -l .)"
+          if [ -n "$files" ]; then
+            printf '%s\n' "$files"
+            exit 1
+          fi
+      - name: Check module files
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+      - name: Check release metadata
+        run: ./scripts/check-release.sh
+      - run: go vet ./...
+
   test:
+    name: test (${{ matrix.os }})
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-go@v7.0.0
         with:
-          go-version: "1.26.x"
+          go-version-file: go.mod
           cache: true
       - run: go test ./... -count=1
       - run: go build ./cmd/codexfold
+      - name: Test native FSKit cache implementation
+        if: runner.os == 'macOS'
+        run: ./scripts/test-native-fskit-cache.sh
+
+  release-config:
+    name: release-config
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: goreleaser/goreleaser-action@v7.2.3
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: check
+
+  windows-compile:
+    name: windows-compile
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Compile all test packages without claiming runtime validation
+        run: go test ./... -run '^$' -count=1
+      - run: go build ./cmd/codexfold
+
+  race:
+    name: race
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go test -race ./... -count=1
+
+  cross-build:
+    name: cross-build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Build Linux and Windows artifacts
+        shell: bash
+        run: |
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "$RUNNER_TEMP/codexfold-linux-amd64" ./cmd/codexfold
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -o "$RUNNER_TEMP/codexfold-windows-amd64.exe" ./cmd/codexfold
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go test -c -o "$RUNNER_TEMP/codexfold-testfs-linux.test" ./internal/testfs
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go test -c -o "$RUNNER_TEMP/codexfold-testfs-windows.test.exe" ./internal/testfs

.github/workflows/release.yml

@@ -0,0 +1,43 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Require a versioned main-branch commit
+        shell: bash
+        run: |
+          git fetch origin main:refs/remotes/origin/main
+          release_commit=$(git rev-list -n 1 "$GITHUB_REF_NAME")
+          git merge-base --is-ancestor "$release_commit" origin/main
+          ./scripts/check-release.sh "$GITHUB_REF_NAME"
+      - name: Verify release source
+        run: |
+          go test ./... -count=1
+          go vet ./...
+      - name: Publish archives and checksums
+        uses: goreleaser/goreleaser-action@v7.2.3
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: >-
+            release --clean
+            --release-notes=docs/releases/${{ github.ref_name }}.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,8 +1,12 @@
 /codexfold
+/codexfold.exe
+/dist/
 /*.sqlite
 /*.sqlite-shm
 /*.sqlite-wal
 *.prof
 *.test
 .DS_Store
 .worktrees/
+xcuserdata/
+*.xcuserstate

.goreleaser.yaml

@@ -0,0 +1,53 @@
+version: 2
+
+project_name: codexfold
+
+builds:
+  - id: codexfold
+    main: ./cmd/codexfold
+    binary: codexfold
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+      - linux
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w -X github.com/samekind/codexfold/internal/cli.Version={{ .Version }}
+
+archives:
+  - id: codexfold
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else }}{{ .Arch }}{{ end }}
+    files:
+      - LICENSE
+      - NOTICE
+      - README.md
+      - CHANGELOG.md
+
+checksum:
+  name_template: checksums.txt
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-next"
+
+changelog:
+  disable: true
+
+release:
+  prerelease: auto
+
+report_sizes: true