agent: lumotia — v0.1 release-completion run

Closes the code-side v0.1 ship gate. All quality gates green:
cargo fmt/clippy/test (~327 tests), npm check (0/0), vitest 13/13,
scripts/dogfood-rebrand-drill.sh 8/8.

Phase F — first-run onboarding promoted to v0.1
- FirstRunPage with skip-to-main + failure recovery + event recording
- Six onboarding commands (record/list/has-completed + lumotia_events)
- Storage migration v17 (onboarding_events + lumotia_events tables)

UI hardening (in-scope items from v0.1-ui-hardening.md)
- StatusPill + PostCaptureCard components, 21st preview entry
- Sidebar recording-as-sacred-state (opacity + aria-disabled, reduced-motion)
- Settings 6-section regroup + Help section + Activation log + Privacy toggle
- Error-state copy sweep (DictationPage + SettingsPage, plain-language)
- Global :focus-visible rule, textarea outlines restored
- Ctrl+K / Ctrl+, / Escape bindings in +layout

LLM resilience
- rule_based_extract_tasks (regex-free imperative-verb extractor) +
  extract_tasks_with_fallback wrapper — task extraction never returns zero
- tokio::time::timeout(120s) wraps cleanup/tags/tasks commands

Release artefacts
- LICENSE (canonical AGPL-3.0), CHANGELOG (Keep-a-Changelog format)
- v0.1-release-notes, privacy-and-ai-use, install-warnings,
  tester-onboarding-kit, tester-acceptance-runbook, code-signing-setup,
  apple-silicon-rb08-runbook, virtual-audio-setup, v0.1-contrast-audit
- Workspace versioning + AGPL spdx; npm exact-pin (10 ranges removed)
- AppImage SHA-256 sidecar in build.yml
- README v0.1 section + Reporting-issues; canonical repo slug

Closure pass — items moved from human-required to code-complete
- KI-02 Linux idle inhibit: zbus 5 → org.freedesktop.login1.Manager.Inhibit
- KI-03 Windows sleep prevention: SetThreadExecutionState(ES_CONTINUOUS|...)
- acquire/release_idle_inhibit Tauri commands, wired in DictationPage
- Diagnostic-bundle frontend wire-up (Settings → Help button)
- WCAG-AA contrast fix via .btn-filled-text utility (no token changes)
- 8 destructive-action sites wrapped in plain-language confirm() guards
- KNOWN-ISSUES.md + v0.1-known-limitations.md updated (KI-02/03 fixed)

Scripts
- pre-tag-verify.sh, tag-day.sh, smoke-linux + driver
- parse-diagnostic-bundle.sh, parse-activation-log.py

Per-item audit trail: docs/release/v0.1-completion-status.md
Remaining: W-01…W-08 (signing certs, hardware probes, smoke matrix,
tester recruitment) — see docs/release/v0.1-known-limitations.md.

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,75 @@
+name: Bug report
+description: Something broke. Help us fix it.
+title: "[Bug] "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a bug. Please attach a diagnostic bundle if possible — it speeds up triage by 10x. Generate one via Settings → Help → Generate diagnostic bundle.
+
+  - type: input
+    id: version
+    attributes:
+      label: Lumotia version
+      description: Settings → Help. e.g. v0.1.0
+      placeholder: v0.1.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - Linux (Fedora)
+        - Linux (Ubuntu LTS)
+        - Linux (other)
+        - macOS Apple Silicon
+        - macOS Intel
+        - Windows 11
+        - Windows 10
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Open Lumotia
+        2. Click record
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: diagnostic-bundle
+    attributes:
+      label: Diagnostic bundle
+      description: Drag-and-drop the .zip from Settings → Help → Generate diagnostic bundle. Never includes audio or transcripts.
+    validations:
+      required: false
+
+  - type: textarea
+    id: extras
+    attributes:
+      label: Anything else?
+      description: Screenshots, logs, related captures.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: General questions
+    url: https://github.com/jakeadriansames/lumotia/discussions
+    about: For general questions or design discussions, use Discussions instead of Issues.

.github/ISSUE_TEMPLATE/v0.1-tester-feedback.yml

@@ -0,0 +1,104 @@
+name: v0.1 Tester feedback
+description: You tried Lumotia v0.1. Tell us how it went.
+title: "[Tester feedback] "
+labels: ["v0.1-tester", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for trying Lumotia v0.1. This template captures the structured feedback the tester-onboarding-kit asks for.
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - Linux (Fedora)
+        - Linux (Ubuntu LTS)
+        - Linux (other)
+        - macOS Apple Silicon
+        - macOS Intel
+        - Windows 11
+        - Windows 10
+    validations:
+      required: true
+
+  - type: dropdown
+    id: cold-setup
+    attributes:
+      label: Cold-setup pass (steps 1–4)
+      description: Did you reach "Ready to record" without coaching?
+      options:
+        - "Yes — clean"
+        - "Yes — but I needed help at one step"
+        - "No — I would have given up"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: warm-activation
+    attributes:
+      label: Warm-activation pass (steps 5–10)
+      description: Did you complete your first real recording within 3 minutes of opening the app?
+      options:
+        - "Yes — under 3 min"
+        - "Yes — but it took longer than 3 min"
+        - "No — I got stuck"
+    validations:
+      required: true
+
+  - type: textarea
+    id: confusing
+    attributes:
+      label: What confused you?
+      placeholder: One step you had to re-read, one button you couldn't find...
+    validations:
+      required: false
+
+  - type: textarea
+    id: broken
+    attributes:
+      label: What broke?
+      placeholder: Errors you saw, things that didn't work as expected...
+    validations:
+      required: false
+
+  - type: textarea
+    id: cleanup-tasks
+    attributes:
+      label: Did the cleanup + task extraction make sense?
+      placeholder: Was the cleaned transcript better than the raw one? Were the extracted tasks useful?
+    validations:
+      required: false
+
+  - type: dropdown
+    id: would-use-again
+    attributes:
+      label: Would you use Lumotia again next week?
+      options:
+        - "Definitely"
+        - "Probably"
+        - "Maybe"
+        - "Probably not"
+        - "Definitely not"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: would-pay
+    attributes:
+      label: Would you pay £39 for a Founding Licence?
+      options:
+        - "Yes"
+        - "No"
+        - "Maybe with one or two changes"
+    validations:
+      required: false
+
+  - type: textarea
+    id: activation-log
+    attributes:
+      label: Activation log (optional)
+      description: Settings → Privacy → Activation log → click rows to copy. Local-only by default — only paste if you're comfortable.
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## What this PR changes
+<!-- One or two sentences in user-facing voice. Not commit-log style. -->
+
+## Why
+<!-- The user-facing reason. Bug fix? New feature? Hygiene? -->
+
+## How tested
+- [ ] `cargo test --workspace` green
+- [ ] `cargo fmt --check` clean
+- [ ] `cargo clippy --workspace --all-targets -- -D warnings` clean
+- [ ] `npm run check` 0/0
+- [ ] `npm run test` green
+- [ ] `scripts/dogfood-rebrand-drill.sh` 8/8 (if migration / data-dir touched)
+- [ ] Manual UI walk-through (if frontend touched)
+
+## v0.1 scope check
+- [ ] Confirms or extends an item in `docs/release/v0.1-checklist.md`
+- [ ] Does NOT touch any item in the v0.2 / v0.2-garden-roadmap scope
+- [ ] Does NOT remove any privacy invariant (no telemetry, no exfiltration, no AI-driven feature additions outside the locked scope)
+
+## Notes for the reviewer
+<!-- Architectural decisions, surprising choices, follow-up TODOs. -->

.github/workflows/build.yml

@@ -14,13 +14,12 @@
 #   Promote the draft to a release when ready.
 #
 # Signing:
-# - macOS code-signing not configured. The .dmg will trigger Gatekeeper
-#   warnings on the first run; users will need to right-click → Open.
-#   To wire signing later, set APPLE_SIGNING_IDENTITY +
-#   APPLE_CERTIFICATE secrets and uncomment the env block.
-# - Windows code-signing not configured. The .exe/.msi will trigger
-#   SmartScreen warnings on first run. To wire signing later, set
-#   WINDOWS_CERTIFICATE + WINDOWS_CERTIFICATE_PASSWORD secrets.
+# - macOS: signing + notarisation activate automatically when the
+#   APPLE_* secrets are set in the repo. Builds unsigned if absent.
+#   See docs/release/code-signing-setup.md for the cert walkthrough.
+# - Windows: signing activates automatically when WINDOWS_CERTIFICATE
+#   + WINDOWS_CERTIFICATE_PASSWORD are set. Builds unsigned if absent.
+#   See docs/release/code-signing-setup.md for the cert walkthrough.
 name: build
 
 on:
@@ -48,6 +47,7 @@ jobs:
           - os: ubuntu-22.04
             artifact_glob: |
               src-tauri/target/release/bundle/appimage/*.AppImage
+              src-tauri/target/release/bundle/appimage/*.AppImage.sha256
               src-tauri/target/release/bundle/deb/*.deb
           - os: windows-latest
             artifact_glob: |
@@ -143,12 +143,20 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Uncomment when signing certs are configured in repo secrets:
-          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          # WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          # WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+          # macOS code-signing + notarisation. Builds unsigned if these secrets aren't set.
+          # Set via: gh secret set APPLE_SIGNING_IDENTITY --body "..." (etc.)
+          # See docs/release/code-signing-setup.md for the cert procurement walkthrough.
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # Windows code-signing. Builds unsigned if these secrets aren't set.
+          # Set via: gh secret set WINDOWS_CERTIFICATE --body "..." (etc.)
+          # See docs/release/code-signing-setup.md for the cert procurement walkthrough.
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
         with:
           # If pushed as a tag, use the tag name; otherwise leave empty
           # so tauri-action builds artifacts but does not touch releases.
@@ -159,6 +167,18 @@ jobs:
           # Build all bundle types the OS supports.
           args: ''
 
+      - name: Compute AppImage SHA-256
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd src-tauri/target/release/bundle/appimage
+          for img in *.AppImage; do
+            sha256sum "$img" > "$img.sha256"
+            echo "Generated: $img.sha256"
+            cat "$img.sha256"
+          done
+
       # Always upload as an Actions artifact too — accessible from the
       # workflow run page even if the release-creation step was skipped.
       - name: Upload artifacts