52 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	7d8daca111	sick days: one shared sickdays pool, 20:00 shutdown floor, one-tap lock button ... A sick day is now a date in the shared sickdays pool (utils sickdays 0.1.0) and nothing else. Removed: the 7/30/90-day budget, the escalating lockout countdown, the justification form, the commitment prompt and its double debt, the workout-debt counter, the -60 min shutdown cut and its sick_day_state.json, the post-sick-day --verify-workout mode, the sick auto-upgrade, scripts/revoke_sick_day.py and their tests. - Lock screen: "I'm sick" on the retry, no-phone and both Tue-Thu screens; one tap -> sickdays.add_sick_day(today) -> sick floor -> best-effort background sickdays.sync_quietly -> unlock. Refusals (free day, unreadable pool) are shown and the lock stays. - Shutdown: the reset resolves with earned_time.resolve(..., sick=True) (max(20:00, ladder), capped 23:00) and saves the sick lift with the grace lift, so later credits absorb it instead of stacking on 20:00. A day marked after the reset is lifted by the new _sick_floor live pass (every 5-min tick, --sync-only, --apply-bonuses, and the tap itself). - Workout lock and grace floor stand down on a sick day; workouts that day credit normally through the sync paths. - wake-alarm workday_penalty.json is void when its issued_date or penalty_date is a sick day. - Status window, i3 line, CLI --status, MCP flags and web reasons read sickdays. - scripts/migrate_sick_history.py imports sick_history.json's dates via sickdays.import_legacy, verifies and removes the file; idempotent, run by install.sh. - Pins: earned-time 0.11.0, freedays 0.4.0, sickdays 0.1.0 (tags pending); pre-commit 4.7.0, ruff 0.17.1 (freshness gate). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xfj1sxKH9VBPqpcAni8Jry	2026-10-16 13:30:39 +02:00
Krzysztof kuhy Rudnicki	3c1b983c2a	deps: earned-time 0.10.0 (tutor quota per weekday: Tue-Thu 15, Mon/Fri 30, Sat/Sun 50 min) ... Claude-Session: https://claude.ai/code/session_01E57caQF4KXwEvqEnKtJiHM Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-12 21:17:14 +02:00
Krzysztof kuhy Rudnicki	96ad163ee6	earned_time 0.9.0: tutor earner renamed automation -> tutor ... Pins bumped at all four sites; tests follow TUTOR / tutor_bonus_units. pylint 4.1.3 (freshness gate). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YADHKXzZhhePzQ2rNoXFcK	2026-10-12 16:38:25 +02:00
Krzysztof kuhy Rudnicki	5eb18b92ca	deps: earned_time 0.8.0 (tutor credit per active minute); tutor rung tests for minute rows and legacy blocks ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-10 18:32:43 +02:00
Krzysztof kuhy Rudnicki	384ffcda7d	tests: earned_time 0.7.0 tutor policy (confirmed, 15 min per block); hook envs on 0.7.0 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-10 15:15:35 +02:00
Krzysztof kuhy Rudnicki	2140ca5180	deps: earned_time 0.6.1 (tutor cutover; new-gate rungs spare the floor) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-10 08:24:48 +02:00
Krzysztof kuhy Rudnicki	3a2ad0245c	deps: ruff 0.17.0 (CPY001 ignored: no copyright policy) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-09 22:05:02 +02:00
Krzysztof kuhy Rudnicki	bbc14ec04c	earned_time 0.6.0: per-day registry consumer, sleep-ladder date-proof tests, pin v0.6.0 ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-09 21:36:53 +02:00
Krzysztof kuhy Rudnicki	19ccad6978	deps: freedays 0.3.1 (pins crdt-sync 0.9.2); pre-commit hook pins back in step ... freedays 0.3.0 pinned crdt-sync v0.9.1 exactly, which a clean venv could not resolve next to screen-locker's own crdt-sync 0.9.2. The pylint hook environments had also drifted from pyproject.toml (crdt-sync 0.9.1, earned-time 0.3.0). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018RHwVPyiiQMPh4M3JQwQku	2026-10-09 20:56:32 +02:00
Krzysztof kuhy Rudnicki	ec7f4805f7	pin earned-time-v0.3.0 (registers the automation earner) ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-05 15:20:10 +02:00
Krzysztof kuhy Rudnicki	2dd719e6a4	earned-time-v0.2.0 (anki); shutdown projection prices each day on its own date ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-05 14:18:42 +02:00
Krzysztof kuhy Rudnicki	ed5fa133d0	shutdown: derive base and bonuses from the shared earned_time registry ... The base hour, the workout/LeetCode/reading hours and the reading cut date were duplicated here and in steam-backlog-enforcer. They now come from earned_time (kuhyx/utils, earned-time-v0.1.0): the reset sums the registry, the live pass iterates its flat earners (stamps unchanged: <name>_bonus_date), and _leetcode_bonus/_reading_bonus are replaced by the shared HMAC ledger reader. A gate registered later needs no code here. The schedule still stores whole hours; _earned.to_hours raises on a remainder rather than flooring it. Verified identical to the old code on today's real ledgers and log (reset target, stamps, live passes, base hours). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Aktgaq93yt51c6D3X5Fzsm	2026-10-04 18:55:51 +02:00
Krzysztof kuhy Rudnicki	279a7b1ed7	repo contract: CLAUDE.md commands, test_changed, CI gate ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-04 17:15:50 +02:00
Krzysztof kuhy Rudnicki	0b0cda6782	Morning-session reader moves to gatelock 0.9.0 ... _morning_session.py is now a thin binding of screen-locker's path and retry budget over gatelock.morning_session, shared with leetcode-guard and book-guard; the verdict tests live there once. Same behaviour, same string. Also bumps mypy 2.4.0 / pylint 4.1.1 / ruff 0.16.10 (newest stable gate) and the stale gatelock pins in install_systemd.sh and the pylint hook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FBbkN4ZB4aUPJPzR2prRan	2026-10-02 14:05:40 +02:00
Krzysztof kuhy Rudnicki	deb89b3e03	Relaxed days from freedays.WORKDAYS; delete the dead rtcwake mixin and its stale ALARM_DAYS ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-27 20:24:01 +02:00
Krzysztof kuhy Rudnicki	885951ee2b	pre-push is a 1-second stamp check; the suites moved to the manual stage ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-20 19:35:35 +02:00
Krzysztof kuhy Rudnicki	9b39196671	Take gatelock 0.8.1: nested LockConfig ... The grab axes are grab=GrabPolicy(kind=..., disable_vt=..., preempt_weaker_holder=...) and every colour read goes through config.palette; nothing about the lock's behaviour changed. Also carries the pylint hook on 4.0.8 with the source-only scope config; the gate stays at 8.0 until the remaining findings are cleared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHCbkJWXHjtTUaqvnHRAqA	2026-09-12 19:52:38 +02:00
Krzysztof kuhy Rudnicki	e98884b200	Re-point paths for the ~ reorganisation (home-tidy) ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwtowrowDXx6ccmWVPkCaF	2026-09-11 18:46:28 +02:00
Krzysztof kuhy Rudnicki	f716b9529f	Pin freedays v0.2.0 ... v0.2.0 drops freedays's gatelock dependency (importing gatelock pulled in tkinter, so the headless pool needed a GUI toolkit) and adds the sync timer that makes a day marked on the phone actually reach this machine. Mechanical, but not optional: the freshness gate compares the pinned tag against the newest release, so leaving v0.1.0 here would turn this repo red on its next commit. Suite re-run against v0.2.0 before pinning it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-07 15:58:57 +02:00
Krzysztof kuhy Rudnicki	d6e8c0973f	Replace scheduled skips with the shared free-day pool ... Fifth and last app onto freedays (~/utils/freedays). screen-locker is the one that already had this idea: scheduled_skips.json was a bare list of dates, checked first in the lock chain, that only this app could see. That is exactly what the shared pool generalises, so the chain now asks freedays and a day taken here also stands down diet-guard, wake-alarm, leetcode-guard and home-guard. Sick days are deliberately untouched. Their rolling windows (1/7d, 3/30d, 10/90d), the 120-character justification and the escalating countdown all exist to make a sick day *hard* to take. Free days are the opposite -- declared ahead, no reason, consecutive runs allowed. Merging the two policies would have had to ruin one of them, so only the storage of the frictionless half moved. This fixes a real bug in passing. is_scheduled_skip_today compared against a UTC day while add_scheduled_skip.py wrote a local one, so a skip added near midnight could name a date the chain never matched. freedays owns "what is today" for both sides now, in local time, and the disagreement cannot recur. scripts/migrate_scheduled_skips.py moves the existing dates across; it is idempotent and has a --dry-run. Already run here: the 8 real skips (2026-05-19/20/21, 05-29, 05-30, 08-17, 08-22, 08-29) are in the pool and count against 2026, leaving 27 of 35. The original file is gitignored and was left on disk untouched. add_scheduled_skip.py becomes a thin wrapper over freedays rather than being deleted, because arm.sh calls it and the name is in muscle memory. Left as-is it would have kept writing to a file nothing reads. conftest.py went over the 250-line cap, so the two fixtures that keep the suite off real user state moved to _real_state_fixtures.py. They belong together and neither subsumes the other: _isolate_home covers paths resolved from Path.home() at call time, while the freedays redirect covers paths bound into module constants at import time, which redirecting home afterwards cannot reach. requirements.txt also takes pytest-randomly 5.0.0, ruff 0.16.6 and types-requests 2.33.0.20260906, and the pylint hooks' gatelock/crdt-sync pins move off v0.7.1/v0.9.0 -- pip refuses two direct URLs for one distribution, so those stale pins would have made the hook environments unresolvable rather than merely old. 1256 tests, 100% branch coverage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-07 15:42:41 +02:00
Krzysztof kuhy Rudnicki	8f911585c1	Serve the lock decision, its history and its health at 127.0.0.1:8770 ... The only status surface was a GTK tray icon, commented out of ~/.config/i3 on 2026-08-21. So when the weekly count went wrong, nothing on the machine said so for two weeks -- the same silence that let a deleted timer job stop enforcement for thirteen days in August. Three read-only endpoints, and a React 19 UI over them: /api/status the decision, the week, and whether today has a workout /api/decisions the recorded trail, newest first /api/health timers armed, disarm marker, log and trail freshness The Why view is the one that matters: it renders the run of "weekly_minimum_met 5/5" ticks that hid this week's bug, without anyone having to reach for journalctl. /api/status also carries gaming.workout_today, which is the fact steam-backlog-enforcer will cut the daily budget on. Deliberately just the fact -- the enforcer owns the hour values, so the two repos cannot come to disagree about what a workout day is. It is derived from count_day_credits, the same rule the locker enforces with. _compliance_state_word moves from status_view (tkinter) into _status_projection, and the systemd arming check moves from scripts/check_enforcement_armed.py into screen_locker/_armed_state.py, so the server can answer "is enforcement armed" without a second copy of the logic that would be free to disagree with the gate. web/ mirrors steam-backlog-enforcer/web but tightens it: that config has no "strict" in any tsconfig, extends only tseslint recommended (no type-aware rules at all), and gates neither lint nor typecheck in pre-commit. Here all three run, on strictTypeChecked + stylisticTypeChecked, with noUncheckedIndexedAccess and exactOptionalPropertyTypes. 44 tests, 100% of statements, branches, functions and lines. typescript stays pinned at 6.0.3: 7.0.2 is out, but every published typescript-eslint -- stable, canary and rc-v8 -- declares typescript ">=4.8.4 <6.1.0". The fleet allowlist already carries that entry. The 250-line cap now covers ts/tsx. It was python/shell/dart only, which would have made web/ exempt from the gate the rest of the repo lives under -- the same omission that exempted the whole Flutter app until 2026-08-15. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fcwu78wk17FWMHbbfbyicc	2026-08-29 22:50:19 +02:00
Krzysztof kuhy Rudnicki	d67c770cc9	Latest stable dependencies, and the gate that keeps them there ... Python side: gatelock v0.7.1 -> v0.7.2 and crdt-sync v0.9.0 -> v0.9.1 (both re-cut so consumers stop resolving pre-upgrade constraints), plus every `>=` floor turned into an exact pin -- five majors among them (mypy 1 -> 2.3.1, pylint 3 -> 4.0.7, pytest 8 -> 9.1.1, pytest-cov 4 -> 7.1.0, ruff 0.8 -> 0.16.5) and mcp pinned at 2.1.1. `scripts/ci_mirror.sh` builds a clean venv from requirements.txt and runs the whole CI set: 1146 tests, 100% branch coverage, no lint or type finding. workout_app: sync_settings_ui v0.1.0 -> v0.4.1 and ten exact pins, with the flutter_secure_storage 11 chain (compileSdk 37 / AGP 9.3.2 / Gradle 9.7.1). 411 tests green, analyzer clean, release APK builds. CI's Flutter pin was 3.44.6 while `.fvmrc` says 3.47.2 -- the drift that made kuhylog red on a commit that is clean locally. Both workflows now say 3.47.2, and the gate reads that pin from now on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK	2026-08-28 15:13:11 +02:00
Krzysztof kuhy Rudnicki	a889341979	Adopt the four markdown namespaces and gate them ... Renames this repo's markdown onto README.md / CLAUDE*.md / DOCS*.md / TODO*.md so a future session can tell a live task from a finished record without reading the file to find out. TODO files carry the literal "REMOVE ME AFTER FINISH" and are deleted when the work lands. Enforced by the md-naming pre-commit hook and CI workflow, both delegating to the shared gate in kuhyx/utils so this repo's idea of a valid name cannot drift from every other repo's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A47aX5DJwmA3QFn3pkEWi7	2026-08-24 15:53:42 +02:00
Krzysztof kuhy Rudnicki	16ada6e5a2	Tell "could not check" apart from "no workout", and stop double-granting bonuses ... A real 1h57m workout on 2026-08-24 synced to Firebase and the locker still locked the screen. The trigger was auth: screen_locker was the only app with no cached firebase_auth.json, so it fell back to a stale shared password and got HTTP 400 every run. The defect was what it did next — an unreadable primary source was reported as "no workout" rather than "could not check", which is the same conflation that took 2026-06-12. Recover the session by borrowing a live refresh token from a sibling app, track degraded sources as state instead of a log line, and say so on the lock screen: name the backend, the error, and how stale the data is, so a sync fault reads as a sync fault. Also fix two bugs found while finishing the recovery: restore_and_bonus.py banked `existing + bonus` with no idempotence guard while finish_2026_08_24.sh advertised "safe to re-run" — a second run silently granted the compensation hours again. Guard on a durable `shutdown_bonus_granted_for` list; the bonus map alone cannot answer the question, since a week's total mixes earned streak hours with corrections. _extra_benefits._save_state rebuilt state from four hardcoded keys, so the next weekly rollover would have dropped that guard and re-armed the double-grant. Merge onto loaded state instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EJmPLyT8NU4DzDJPV1KEX5	2026-08-24 13:07:20 +02:00
Krzysztof kuhy Rudnicki	2c206e5070	Adopt crdt-sync v0.9.0's bundled sync_log signature ... sync_log's eleven flat keywords became SyncTarget / LogCodec / RevisionTracking upstream. Call sites and test doubles follow; the hook's own pinned crdt-sync moves to v0.9.0 too, so the gate checks against the API the code actually imports rather than an older tag. No behaviour change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VCucBhUkHBBHHbsY7bSdGV	2026-08-21 14:28:14 +02:00
Krzysztof kuhy Rudnicki	957e4566c2	Bump gatelock pin in pre-commit's pylint hooks to v0.7.1 ... Missed alongside the main dependency bump -- pre-commit's pylint hooks pin gatelock separately via additional_dependencies, so they were still resolving wait_for_turn against the old v0.4.0 tag. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018M5gKyYzxWG6QkCaj1wWfk	2026-08-21 13:09:34 +02:00
Krzysztof kuhy Rudnicki	e5db25468d	Re-arm the locker, and make a disarmed enforcer impossible to miss ... The screen locker stopped locking on 2026-08-04 and nobody could tell. Not a logic bug: every predicate worked the whole time. systemd logged timers.target: Found ordering cycle: early-bird-workout-check.timer/start after graphical-session.target/start after basic.target/start after timers.target/start - after early-bird-workout-check.timer timers.target: Job early-bird-workout-check.timer/start deleted to break ordering cycle starting with timers.target/start and left the timer disabled. A timer that is WantedBy=timers.target must not be ordered After= a target that itself comes after timers.target; systemd resolves that loop by deleting the job, which is an absence, and absences page nobody. That timer is the ONLY thing that closes the early-bird window. Each morning a run inside the window banked early_bird_pending.json, logged "will re-check at 08:30", and exited 0. The re-check never came, so the marker stood all day, every day, for thirteen days. It stayed invisible because logging.basicConfig was called only in the --sync-only branch, never for --production -- the mode systemd actually runs. Journal proof: zero INFO lines from workout-locker.service since June. Every early exit logged at INFO into a logger with no handler. Meanwhile the healthy 15-minute sync kept the system looking alive. The 2026-08-15 Python split is NOT implicated: it was pure code motion, and basicConfig already sat in that branch before it. Fixes: * Drop the After= that closes the cycle; Persistent=true so a machine asleep at 08:30 still re-checks after resume. * Add workout-locker.timer (*:00,30). The service is WantedBy= graphical-session.target, i.e. one decision per login, so the 08-16 -> 08-17 day and ISO-week rollover inside one long session was never re-evaluated. * arm.sh: install units, enable timers, verify -- one command, because re-arming was a four-command sequence that was easy to half-do, and `systemctl enable` returns 0 while systemd deletes the timer job. * check_enforcement_armed.py asks systemd what it actually scheduled (enabled AND has a next trigger) and fails loudly otherwise. Wired as ExecStartPost on workout-sync.service, so a disarmed locker marks that unit failed every 15 minutes instead of scrolling past. install_systemd.sh now fails on it too. Logging (the reason this went unnoticed, so treated as a defect in its own right): * basicConfig for every mode, never one branch. * Every enforcement-abandoning exit records a decision instead of an invisible INFO: one greppable line -- DECISION lock=no reason=early_bird_window_active weekly=0/5 -- at WARNING, since per CLAUDE.md an INFO explanation of a non-action is a silent failure with extra steps. The enforced case is logged too: "no line at all" was the outage's whole signature. * A durable JSONL trail outside the repo (~/.local/share/screen_locker/), so "when did this last actually enforce?" survives journal rotation. --status and --sync-only record lock=n/a; "did not decide" must never look like "decided not to lock". * check_silent_failures.py now also catches sys.exit(0) that explains nothing. Verified both directions: it flags 3/3 exits in the pre-fix _auto_upgrade.py and passes the repo clean. Sync noise: four records replayed as WARNINGs every cycle (~384/day), which is how the actionable lines got tuned out. manual_workout:2026-08-15 is an empty stub ({date, kind, type}) -- no workout to recover, and that day's credit was already counted under a different sync_record_id, so no credit was ever lost. The three "collided" records are dedup working. Both now report at info; a WARNING from this logger again means something real. 4 -> 0 per cycle. Verified on the live system: the periodic timer fired at 16:45 and the journal shows `DECISION lock=no reason=scheduled_skip_day weekly=0/5` -- the line that did not exist for thirteen days. Both timers report enabled and scheduled, and no ordering cycle recurs. Today is a scheduled skip so the machine was not locked mid-session; enforcement resumes tomorrow 08:30. 1007 tests, 100% coverage, all hooks green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F2b6ZjBcdrkSYnMujx4mWd	2026-08-17 16:47:25 +02:00
Krzysztof kuhy Rudnicki	22294ec541	Enforce the 250-line cap for real, and on Dart ... The gate this whole refactor was aimed at had two holes: - `MAX_LINES` was 400, while `refresh_refactor_todo.py` reported against 250. The hook and the TODO generator disagreed about what "over the cap" meant. - `types_or` was [python, shell], so the hook had never inspected a single Dart file. Every file in the refactor — workout_screen.dart at 633 lines included — was exempt from the check it was being split to satisfy. A violation also exited 1 while printing nothing, so a developer got a failed commit with no indication of which file or by how much. It now names the file and the overage on stderr. Verified by planting a 260-line Dart file: the hook exits 1 and reports it. Boundary checked at 250 (pass) / 251 (fail). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EveB813BQ8abAP68VSqZ5Y	2026-08-15 22:42:57 +02:00
Krzysztof kuhy Rudnicki	76a4c6a0a7	Finish the Python side: scripts, conftest, and the last test modules ... verify_lock_popup_safety.py (318) -> _xvfb_reexec.py shared re-exec _popup_form_check.py HostileLock, ticks, the real-form check verify_screen_fits.py (266) -> uses _xvfb_reexec too conftest.py (329) -> _tk_mocks.py the tk mock + the module patch list _opt_in_fixtures.py requestable fixtures three test modules -> _part4/_part5/_part15 siblings conftest keeps every autouse fixture. pytest applies autouse fixtures from conftest only, so one moved to a sibling would silently stop running and take its safety guard with it -- verified by asserting the fixtures are still listed, not just that the suite is green. The five near-identical _isolate_* fixtures collapse into one table-driven _isolate_state_files, which also picks up the _shutdown_sick_state binding an earlier split created. scripts/ becomes a real package so the shared helpers are importable. Both gates now run as `python3 -m scripts.<name>`, including CI -- the path form put scripts/ on sys.path instead of the repo root, and the alternative was a try/except ImportError that this repo's no-silent-failures hook rightly rejects. Each gate was run in its exact invocation form. Note: verify_lock_popup_safety still fails on `RecoveryLoop.__init__() takes 3 positional arguments but 6 were given`. That is pre-existing -- confirmed by running it at HEAD in a clean worktree before touching it -- a gatelock API drift, not this refactor. Left as found. 978 tests at 100% branch coverage. Gate: 41 -> 22 files, all remaining ones Dart plus DESIGN_AUDIT_TODO.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EveB813BQ8abAP68VSqZ5Y	2026-08-15 20:57:29 +02:00
Krzysztof kuhy Rudnicki	3476dd3afd	Split the last 8 test modules; scope pylint's test-inherent checks ... Splits test_screen_lock_coverage_part2 via a shared _unlock_helpers.setup_unlock factory rather than duplicating the fixture, and finishes the remaining runnerup/manual-workout/status-view test modules under the 250-line cap. Also splits the pylint hook in two. protected-access, unused-argument and duplicate-code are how pytest and unit-testing private mixins work, not defects, and a commit made entirely of test files could never clear the 8.0 batch score with them counted. Source keeps the full rule set — verified that an injected protected-access is still reported there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EveB813BQ8abAP68VSqZ5Y	2026-08-15 19:40:32 +02:00
Krzysztof kuhy Rudnicki	3a5f0962de	Add a pre-commit gate against a local crdt_sync dependency_override ... A dependency_override pointing crdt_sync at a local path is invaluable while developing an unreleased library change, and silently catastrophic if it survives the commit: local tests go green against code CI never built. Enforce it can't ship instead of relying on someone remembering to remove it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013SH7XBkpEqQX4KghHdgx9T	2026-08-12 19:18:21 +02:00
Krzysztof kuhy Rudnicki	aab51eed2d	Carry progression through Firebase, and stop demanding storage permission ... Progression and the in-progress session now live at screen-locker-sync/exercise_state/<name> and .../active_session — siblings of devices/, not inside it. Both workout readers (_workout_sync.py:113 and workout_sync_service.dart:307) list only screen-locker-sync/devices, so a progression record is structurally invisible to them and cannot be miscounted as a workout, which would silently grant unlock credit. Keyed on exercise name because a reinstall mints a new per-install uuid. Startup no longer calls requestStoragePermission(): that threw the user into a system Settings page on every launch, for a permission that is now genuinely optional. It only checks; the grant moved to an OFFLINE BACKUP section in Settings, its sole caller. The clobber guard keys on a persisted progression_synced_at marker, NOT looksFreshlyInstalled(). The only production caller (_finishWorkout) writes a workout_history row and last_workout_type BEFORE it pushes, so a freshness test was already false by then and could never fire — a reinstall that connected Firebase late (the uninstall wipes the keystore, so startup's pull finds no account) would have overwritten every real remote record with factory defaults on its first finished workout. Connecting in Settings now pulls immediately, which closes that window. The same marker stops a pull reverting a deliberate setExerciseWeight/resetExerciseToDefaults, which write no history at all. Also adds a Dart silent-failure pre-commit hook. The Python one is types:[python] and had never looked at a single Dart file — in the app where a swallowed sync error costs the user a workout with nothing anywhere saying so. It found 21 real silent swallows (keystore reads/writes, /sdcard mirror failures, the HTTP bind, device-flow polls, and a .catchError((_) {})), all now logging why. Verified on the Pixel 6a: reinstall + deny storage + connect late restored Bench 22.5→20.0, Row 22.5→25.0, Situp 30→31 reps with the remote copy untouched; the RTDB device list stayed at exactly 3 entries and no progression leaked into pull_synced_workout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JupKvZCNKRmEeRQY3G1unG	2026-08-10 16:54:21 +02:00
Krzysztof kuhy Rudnicki	ffc6c72df0	Push under a persisted per-install uuid, not a fixed role id ... screen_locker pushed manual workouts as "pc" and the workout app as "phone". A role constant collides the moment a second machine takes the same role, and after a reinstall the new install inherits the previous one's CRDT identity. Both halves now mint a uuid once and persist it: the PC in ~/.local/share/screen_locker/.device_id, the app under SharedPreferences 'crdt.nodeId' -- the same key every sibling app uses. The old constant survives as the legacy id and is passed to sync_log / syncLog, so devices/<legacy>/ is skipped as this device's own rather than re-downloaded and re-merged as a peer's on every tick. It drops to None once that path is reclaimed. Note the *read* loop in _workout_sync deliberately still merges every device including this one: the PC needs its own manual workouts in the merged view, so "skip own" would be wrong there. Only the push path and the HLC node id move. The test fixture redirecting the new id file is added in the same change that introduces the constant -- without it the first test that syncs mints a uuid into the real state dir and this machine's live sync identity is decided by whichever test ran first. Verified: ~/.local/share/screen_locker/ held no .device_id after a full suite run. Verified against the live backend, not just mocks: ran the real push_pc_workouts, which minted 57582b3b and pushed 9 records. In the RTDB the new device's log is a strict superset of both old paths -- 0 of devices/pc/'s 10 records and 0 of devices/phone/'s 9 are missing from it. Python: 907 tests, 100% branch coverage. workout_app: 313 tests, analyzer clean. Pins bumped to crdt-sync-v0.6.0 / crdt_sync_dart-v0.7.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GZH89WEqAjuJT8WZdqc7AP	2026-08-09 17:31:15 +02:00
Krzysztof kuhy Rudnicki	eb4ff01e04	Sync workouts through Firebase, mirroring to GitHub during the cutover ... Both surfaces of this repo move together, because they share one prefix: screen_locker (the PC, which reads what the phone logged) and workout_app (the phone, which writes). Firebase becomes the primary backend when it is set up, with GitHub kept as a mirror so a device that has not moved yet is still seen. MirrorSyncClient reads the union of both, so a workout logged against either backend still counts -- which is what lets the PC and the phone cut over on different days. The PC's two pulls are read-only, so they need only the client swapped. _manual_push does a real sync_log and now carries a revision cache, as does every push in workout_app: without it each push re-uploads the whole log and each pull re-downloads every peer's, regardless of change. remote_client is public rather than _private because _manual_push imports it; one decision point beats two copies that can drift. The config file is checked before constructing anything, so an unconfigured machine never reaches the network -- without that guard the PC's sync tests asserted against live Firebase data instead of their own fakes, which is how this was caught. screen_locker: 904 tests at 100% branch coverage. workout_app: 299 tests at 100% line coverage; pinned v0.1.0 -> v0.6.0 across three minor versions with no API drift. Four assertions moved off `.single`, which now finds two writes: the log, then the revision published after it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ9sxEw3ymzXNjL7SHNpJc	2026-08-05 08:12:40 +02:00
Krzysztof Rudnicki	7e04cf784b	Move the crdt-sync pin to v0.3.0 ... Your in-progress bump, committed as its own change so it is not buried in anything of mine. All three declaration sites move together -- the manifest, the lockfile-equivalent and pylint's hook env -- because a pin that lags the others lints the code against a library it does not actually run with. Verified in a clean venv that v0.3.0 still provides every symbol this repo imports: GitHubSyncClient, GitHubSyncError, Hlc, Record and Log. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsXnTHyuuCUZsqetTaajcF	2026-08-03 19:54:40 +02:00
Krzysztof Rudnicki	a0a3fb0eb0	Port the MCP server to mcp 2.x, and say what each tool is allowed to do ... mcp 2.0.0 removed mcp.server.fastmcp; MCPServer is the same object under a new name, so @mcp.tool() and mcp.run() are untouched and every tool keeps its name, signature and returned shape. Verified against a clean 2.0.0 venv: all four tools list, and the whole suite -- including test_mcp.py, which could not even import while the dependency was broken -- passes at 100% coverage, 901 tests. Two things the port buys, neither of which existed in 1.x: * Tool annotations. The section banner here already said "state-only; never expose secrets, never mutate"; now the protocol says it too, as read-only, idempotent and closed-world hints, which is what lets a client run these without asking first. The day one of them starts writing, the annotation is what has to change with it. * Structured output. 2.x derives an output schema from the return types and sends structured content alongside the text, so a caller no longer re-parses JSON we already had. No code change -- it falls out of the type hints that were already there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsXnTHyuuCUZsqetTaajcF	2026-08-03 19:48:07 +02:00
Krzysztof Rudnicki	feb7c173d5	Pin mcp below 2.0, and keep the crdt-sync bump out of my commit ... CI has been red in three of these repos since 2026-07-30, for a reason that has nothing to do with any commit made here: mcp 2.0.0 removed mcp.server.fastmcp, which _mcp.py imports at module scope, and the manifests asked for `mcp>=1.9` with no upper bound. Verified directly -- 2.0.0 raises ModuleNotFoundError on that import, 1.29.0 provides it. Pinned `<2` in all three places the dependency is declared (requirements, the optional extra, and pylint's hook env) until the server is ported to the 2.x API. Also backs the crdt-sync 0.1.0 -> 0.3.0 line out of pyproject.toml: that is an in-progress change of yours that rode into dd233b2 when I staged the file for its pylint init-hook. It is untouched in the working tree, where the matching lines in requirements.txt and .pre-commit-config.yaml still carry it, so the three move together whenever you commit them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsXnTHyuuCUZsqetTaajcF	2026-08-03 17:42:01 +02:00
Krzysztof Rudnicki	dd233b27aa	Run the fit check as a module, so it works where nothing is installed ... CI caught what this machine could not: the hook died with "No module named 'screen_locker'". The package is pip-installed here (editable, pointing at this checkout), so running the script by path found it anyway; a fresh checkout has no install, and `python3 scripts/x.py` puts only `scripts/` on sys.path. `python3 -m scripts.verify_screen_fits` puts the repo root there instead, which is the checkout in CI and here alike -- verified in a throwaway worktree, where the module now resolves to the worktree's own package rather than the installed one. The xvfb re-exec runs the same way, with an explicit cwd so the child does not depend on where the parent was invoked from. pylint had the same blind spot for the same reason: it infers sys.path from the files it is handed, so this script resolved its imports only when a package file happened to be in the same batch -- passing or failing by what else was staged. An init-hook puts the repo root on the path unconditionally. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsXnTHyuuCUZsqetTaajcF	2026-08-03 16:34:45 +02:00
Krzysztof Rudnicki	a79c4fdd05	Stop the lock screen scrolling itself, and make every screen fit 768px ... This morning the lock screen scrolled to the bottom and back with nobody touching the keyboard, on the 1366x768 panel. Reproduced under Xvfb with the real app: one programmatic focus_set() produced three scrolls, frac 0.000 -> 0.436 -> 0.145. The cause is in gatelock (fixed in v0.4.0, pinned here): the viewport followed every <FocusIn>, and this app focuses a widget on every repaint. It now follows only focus the *user* moved, and a screen that fits cannot scroll at all. The other half is this app's own layout, because scrolling was covering for screens that did not fit. The manual-workout form needed 1643px of a 768px screen -- SUBMIT and BACK were simply off the bottom: * Every font size and pad now goes through the design-system tokens rather than a literal. A positive size means *points* to Tk, so "36" rendered ~37% larger than the 36px intended; that alone was most of the overflow, on all 88 call sites. * The form's cells put their label beside the field instead of above it, and the three reflection boxes share rows instead of taking one each. Result, measured by the new scripts/verify_screen_fits.py (a pre-commit hook now, so this cannot come back quietly): the form is 752px of 768px, and every other screen -- including heat-skip, which had no viewport at all -- fits with room to spare. Also fixed, all found by measuring rather than by reading: content that fits is centred again (the reset-to-top was cancelling it on every repaint), the scrollbar only appears when there is something to scroll, and unlock_screen moved to _unlock_view so screen_lock.py stays under the 400-line cap. Tests: 896 pass. The focus/scroll helpers shipped in 3e77f4e had no coverage at all; test_focus_and_scroll.py covers them now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BsXnTHyuuCUZsqetTaajcF	2026-08-03 15:57:48 +02:00
Krzysztof Rudnicki	3e77f4e232	Make every lock screen keyboard-operable, and add the missing installer ... The locker was not running at all. workout-locker.service crash-looped ~1977 times in a single boot with ModuleNotFoundError while remaining `enabled`, and has no successful start in the retained journal. A locker that cannot start is a locker that does not lock. Root cause: commit 9b420a9 removed the unit's WorkingDirectory and PYTHONPATH=/opt/screen-locker on the (correct in principle) grounds that "screen_locker is now pip-installed" -- but nothing guaranteed that install. There was no installer, /opt/screen-locker no longer exists, and the package was absent from every Python version's user site-packages. The unit lost its fallback and gained a hard dependency on a manual step nobody re-ran. install.sh fixes that as a script rather than a reminder, and *gates*: it fails if the production interpreter cannot import screen_locker, because an installer that reports success while the service still cannot start is precisely the failure above. It also re-asserts an editable gatelock from ~/utils AFTER the package install and verifies it resolves there -- pyproject pins gatelock to a git tag, so a plain install silently replaces a local editable gatelock with a frozen wheel, which was observed removing ScrollableSurface and taking diet_guard down with it. The keyboard work, all of it Tk defaults rather than local mistakes: - Focus was invisible. Tk ships highlightcolor="#000000" -- a black ring on #211D1B -- and relief="flat" removes the depth cue too, so a keyboard user had no indication of where they were. Now set in the _ui_widgets factory, so a new call site cannot omit it. - Enter did nothing. X11 Tk binds <space> on Button and never <Return>. - tk.Text trapped Tab (inserts a literal tab, refocuses itself) and no-opped Shift-Tab; the only exits are the undocumented Ctrl+Tab / Ctrl+Shift+Tab. - The lock and retry screens started with NOTHING focused. on_focus_ready was a documented no-op arguing "buttons only, nothing to focus" -- exactly backwards: buttons are what needs focusing when there is no other window on screen and a global grab is held. - The heat-skip modal grabbed input fullscreen with no focus, no ring, no Return and no Escape. It now focuses the *declining* option, so a blind Return keeps the workout rather than silently skipping it. The manual-workout form's scroll viewport was pointer-only in three ways at once: tk.Canvas has no class key bindings, so ::tk::FocusOK rejected it as a focus stop; nothing bound wheel, PageUp/PageDown or arrows, leaving only a draggable thumb; and canvas clipping does not unmap children, so below-the-fold fields stayed in the tab ring while Tk never scrolled to follow focus -- Tab led to fields the user could neither see nor reveal. Its height was also a magic 0.7*toplevel above ~230-290px of fixed chrome, i.e. satisfied at 1080p and violated at 768p, where SUBMIT/BACK were pushed off the bottom. All of that is gone by deletion: the surface container is now a gatelock.ScrollableSurface, so the inner viewport is redundant. build_surface and _ensure_container both use it, which fixes the same symmetric-clipping problem for EVERY screen rather than one at a time; center_when_fits keeps short screens looking exactly as they did. Re-arming after a repaint hooks into clear_container(), which all ~19 repaint sites already call. "Remember to call settle after painting" is a rule that would eventually be missed, and on a lock a missed re-arm means unreachable content. The aux windows hardcoded geometry("600x400") and ("700x450") while displaying more than that -- the relaxed-day prompt's own button row requests 862px inside a 700px window, sheared at both edges. That pre-dates this work by a wide margin (Tk's default focus ring accounts for 4px of the 162px overflow). They now size to content, floored at the old values and clamped to the display. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 16:25:45 +02:00
Krzysztof kuhy Rudnicki	bc940f1112	Run the flutter hooks with the git hook's environment stripped ... Same defect diet-guard's pre-push gate hit today, latent here: git exports GIT_DIR to its hooks, and the flutter tool shells out to git to identify its own SDK. With GIT_DIR set it reads THIS repository instead of /opt/flutter, so `flutter --version` reports our own HEAD as the framework revision and our URL as the repository, pub resolves the SDK as "0.0.0-unknown", and every dependency constraint becomes unsatisfiable. flutter also caches that answer, so the damage outlives the hook run and follows the next caller into another repo. Both flutter gates now clear the git variables at the point of use. Verified by running the analyze hook with GIT_DIR set, which failed before and passes now. Also fixes the SC2295 shellcheck finding the coverage script had been carrying -- it only surfaced now because no change had touched a shell file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 15:28:52 +02:00
Krzysztof kuhy Rudnicki	f617be72b4	Type the surface groups properly and exempt the test helpers by name ... Two things the CI mirror caught that the local pre-commit run did not. The groups were annotated with `Any`, which ANN401 rejects. They are generic over the widget they mirror now (`WidgetGroup[tk.Frame]`, `[tk.Text]`, ...), so each subclass keeps its own methods typed instead of erasing them -- better than the `Any` it replaces, not just quieter. `name-tests-test` requires every tracked file under tests/ to be named test_*. The two helper modules the conftest split produced are not tests, so they join the exemption `_status_view_helpers.py` already had; the pattern is generalised to private (leading-underscore) helper modules rather than listing files one at a time.	2026-07-25 16:56:59 +02:00
Krzysztof kuhy Rudnicki	600d0fd084	Migrate screen_locker to gatelock v0.2.0 per-output locking ... The lock now paints one container per live output instead of one window on the primary, and claims the screen through an Arbiter at RANK_SCREEN_LOCKER so the wake alarm can outrank it. The fan-out happens at the widget factory, not the render loop. Painting a screen here is not a pure function -- the ~20 clear_container() flows record workouts, credit weeks and branch on state while they paint -- so re-running a flow per surface would double those side effects. Instead `_label`, `_button_row` and friends build N copies and return a group that mirrors later configure calls to all of them, and a flow body still runs once. Frame groups nest, so `_button(button_row, ...)` reads exactly as it did. The degenerate case carries as much weight as the general one: the status window, the post-sick-day verify window and the relaxed-day prompt have no lock and no surfaces, and share this same factory. They get a group of exactly one frame and behave as they always did. Text boxes are the one thing that cannot be shared. Entries fan out over a single StringVar, but tk.Text has no such variable, so the sick-day description genuinely diverges per monitor; TextGroup.get() returns whichever copy was actually typed into, preserving "answer on any monitor". Tests: the suite hung rather than failed on first run, which is the trap gatelock's own conftest documents -- screen_locker patches its own `tk`, but LockWindow builds Toplevels through gatelock's, and real tkinter over a MagicMock root recurses without bound. `_gatelock_fixtures` closes that and redirects the runtime dir so no test can stand a production locker down. Every other test runs single-output, where fan-out is unobservable, so test_surface_fanout runs on two outputs; each assertion was checked by cropping the group loops to the primary and confirming it goes red. 874 tests, 100% branch coverage, pre-commit clean, no lint suppressions.	2026-07-25 16:26:39 +02:00
Krzysztof kuhy Rudnicki	6629260256	Fix on-fill text contrast on filled buttons, bump gatelock pin ... _ui_widgets.py's _button() always set fg=self._colors.fg (near-white) regardless of bg, so any accent/success/warning/danger-filled button under-contrasted (measured 2.2-3.6:1 vs the 4.5:1 floor). Added _fg_for(bg) so fg is derived from bg instead of hardcoded -- fixes every current _button() call site structurally, not per-instance. Found and fixed 2 more standalone instances of the same bug outside the shared helper (_window_setup.py's demo-close button, _heat_skip.py's heat-skip button). Bumps gatelock to the released v0.1.1 carrying the same on_fill token plus the warm palette rework. Regenerated workout_app's launcher icon assets to match. Verified: gatelock 50/50 + screen_locker 859/859 tests, both 100% coverage; pre-commit (incl. pylint against the real v0.1.1 install) green.	2026-07-21 21:17:14 +02:00
Krzysztof kuhy Rudnicki	79879263ba	Support multiple workouts per day; fix the dead sync; ban silent failures ... The workout log stored ONE workout per calendar day, so a second same-day workout was silently dropped and could never earn credit. Multiple workouts per day: - workout_log.json: {date: entry} -> {date: [entry, ...]}. Legacy entries are wrapped on read (_log_io.load_workout_log) so their HMACs stay valid — no re-signing; every write normalizes the file, migrating it progressively. - New write chokepoint (_log_mixin.write_signed_entry) APPENDS and dedups by a stable workout_id, returning RecordResult so callers can tell a new workout from a duplicate. Re-verifying the same workout is a no-op. - count_weekly_workouts is anti-gaming: each VERIFIED workout counts individually; self-reported manual entries count at most once per day. Four real workouts in one day satisfy the week; four manual entries count as one. - Reward: the day's first counted workout gets the base +2h; an additional same-day VERIFIED workout gets +1h; an additional manual gets nothing. The old "+1h when weekly_count > 4" gate is replaced — weekly volume is the banked bonus's job and shouldn't be paid twice. - Fixed: the unlock screen labelled the +1h "#{weekly_count - 4}", which can render negative under the new rule. Removed the dead runnerup_manual type. - Flutter: the manual budget counts distinct DAYS, matching the PC. PC->phone sync (it had never worked once): - push_pc_manuals pushed from a side-store written at log-time, so anything logged before that feature existed could never publish. _manual_push now derives the crdt log directly from workout_log.json — the single source of truth — covering manual AND verified runs. The record id is the workout's own workout_id (derived for legacy entries to match the phone's format) and the HLC comes from the entry's own timestamp, so a re-push is byte-identical and the repo never churns. - The phone reads every kind (readMergedWorkoutPayloads) and lists the PC's workouts under "SYNCED FROM PC". The manual budget still sees manual-only, so a verified run can't consume a self-report slot. - Settings claimed "Connected." whenever a token STRING existed. It now verifies against the API on open, so a revoked token reports 401 instead of showing a green lie. Never fail silently: - 30 swallowed exceptions across 19 files now log WARNING with the concrete cause AND consequence — plus the token guards in _workout_sync that returned [] in total silence, the exact bug that hid the dead sync for weeks. - New pre-commit hook (scripts/check_silent_failures.py) fails any except that neither re-raises nor logs loudly. ruff's S110 only catches `except: pass`; the real pattern here was `except: log.info(); return []`. Documented in CLAUDE.md. Verified on real data: the Jul 13 run (pulled from its actual TCX over ADB) now counts alongside that day's manual squash, and all three workouts are published to kuhyx/syncs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fv8ULVt3Q67GwCFbM7doHB	2026-07-17 09:22:31 +02:00
Krzysztof kuhy Rudnicki	5390f2043c	Add CI-mirror pre-push gate + requirements-sync check ... Keeps CI green by closing the local↔CI gap that caused this session's red runs: the installed pre-commit hook only checks staged files and the dev env already has every dep, while CI runs `pre-commit run --all-files` and installs a fresh env from requirements.txt. - scripts/check_requirements_sync.py: static hook (pre-commit stage) that AST-scans the package's third-party imports and fails if any isn't declared in requirements.txt — the exact ModuleNotFoundError class that reddened three repos. Fast, runs at commit time. - scripts/ci_mirror.sh: pre-push gate that reproduces both CI workflows — a requirements.txt-only venv (hash-gated, rebuilt only when requirements.txt changes) running `pre-commit run --all-files` + `pytest`. Replaces the old pytest-coverage pre-push hook (subsumed by the clean-venv pytest). A red result blocks the push; `git push --no-verify` overrides. - .ci-mirror-venv/ gitignored; pre-push hook installed. Verified: mirror runs green (747 passed, 100% cov); dep-sync check catches a removed crdt-sync; hash-gate reuses the venv on repeat runs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018PMRRVVkeRyrSaaqueMZKG	2026-07-11 17:42:45 +02:00
Krzysztof kuhy Rudnicki	53140a96e2	Fix pre-existing CI failures (crdt_sync dep, dead type:ignore, ruff) ... CI ran on 399f981 before these fixes landed; both workflows were red: - Tests: ModuleNotFoundError: No module named 'crdt_sync'. CI installs requirements.txt (not pyproject deps), which lacked the crdt-sync git dependency the Workstream-C sync introduced. Add crdt-sync + mcp>=1.9 to requirements.txt (mirrors diet-guard's fix). - pre-commit no-noqa: ~45 `# type: ignore[attr-defined]` comments across _auto_upgrade/_runnerup_db/_status/_heat_skip flagged repo-wide by the no-noqa hook. The mypy hook already runs with --disable-error-code=attr-defined, so every one of these ignores was suppressing an already-disabled check — dead weight. Removed them; mypy and pytest (747 passed, 100% cov) both stay green. Same for the test's redundant `# type: ignore[override]` (override never fired). - pre-commit ruff: FBT003 in _heat_skip.py (tk positional bools, its API) and C901/PLR0912 in _status.py run_status (branchy weekly pipeline by design) — added per-file-ignores with rationale, matching the existing ignores for the sibling validation-chain modules. - Added crdt-sync/mcp/pydantic to the pylint hook's additional_dependencies so pylint can resolve the new imports. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018PMRRVVkeRyrSaaqueMZKG	2026-07-11 17:05:03 +02:00
Krzysztof kuhy Rudnicki	64d253bf91	Point gatelock at the consolidated utils monorepo ... gatelock was folded into github.com/kuhyx/utils as a subdirectory; update the pip git URL across requirements.txt, pyproject.toml, and .pre-commit-config.yaml, and note the screen-locker-sync -> syncs consolidation in the Workstream C planning doc. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-10 14:16:16 +02:00
Krzysztof kuhy Rudnicki	d9119a6582	Add manual (unverified) workout logging with evidence form ... Adds a rate-limited manual-workout entry point (StatusWindow + locked retry screen) for activities like table tennis that ADB/RunnerUp can't verify, gated by a 2/7d + 5/30d budget and a detailed evidence form rather than free text. Full credit toward the weekly minimum, debt clearing, and commitment prompt, matching phone/RunnerUp verification. Also stops tracking personal runtime state (workout_log.json, sick_history.json, extra_benefits_state.json, scheduled_skips.json, shutdown_base.json, early_bird_pending.json) in git — these are regenerated locally and never belong in a public/private repo's history. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AbPcvAvt1JhiRzEyPDE5dA	2026-07-05 20:08:52 +02:00
Krzysztof kuhy Rudnicki	d8c03d78ce	Migrate to the shared gatelock backend ... ScreenLocker now composes gatelock.GateRoot + gatelock.LockWindow for the actual lock window instead of the inline WindowSetupMixin mechanics; the verify/relaxed-day auxiliary windows (never the lock itself) stay as plain Tk windows. The hand-copied _log_integrity.py is deleted in favor of gatelock.log_integrity (the canonical, non-duplicated module). This is the second of three migrations (diet_guard done, wake_alarm next). Two deliberate behavior changes, both confirmed: - dependencies = [] (pure stdlib) now includes gatelock, a documented departure from the prior zero-deps stance. - production grab upgraded from single-attempt-then-local-fallback to diet_guard's retry-forever (robust to e.g. a fullscreen game holding the grab). Net hardening as a side effect: run()/close() now go through gatelock's signal-safe lifecycle, so SIGTERM/SIGINT restore VT switching on every exit path -- previously only a clean close() did, leaving VT switching disabled if the service was killed mid-lock. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XCdT46zV8hESDvbgYMGDLt	2026-06-21 20:11:16 +02:00