chore(deps): upgrade Melos to 8, remove lock files, rewrite CI from scratch

.github/workflows/ci.yml

@@ -13,31 +13,23 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
       # Provides both Flutter and the pinned Dart SDK for the workspace.
-      - uses: subosito/flutter-action@v2
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
         with:
           channel: stable
-
-      - name: Install Melos
-        run: dart global activate melos ^7.0.0
+          cache: true
 
       - name: Resolve workspace
         run: flutter pub get
 
+      # Melos is resolved from the workspace lock, not installed globally.
+      - name: CI
+        run: dart run melos run ci --no-select
+
       # TODO(M0): enable once the first generated code exists (tools/codegen_check).
       # - name: Check generated code is up to date
       #   run: dart run tools/codegen_check/bin/codegen_check.dart
-
-      - name: Format
-        run: melos run format
-
-      - name: Analyze
-        run: melos run analyze
-
-      - name: Architecture rules
-        run: melos run arch
-
-      - name: Test
-        run: melos run test

.gitignore

@@ -1,5 +1,6 @@
 # Dart / Flutter
 .dart_tool/
+pubspec.lock
 *.dart.js
 *.js.deps
 *.js.map

AGENTS.md

@@ -4,7 +4,7 @@ This file is read first. It is short on purpose: it contains the invariants, the
 
 ## What the project is
 
-AlteriOne is a personal universal assistant: one runtime with three modes (`chat`, `task`, `resident`), extensions (built-in or loaded as AOT modules), LLM providers, and LSP and MCP integrations in the MVP. It has a single owner and no multi-user mode. The stack is Dart 3.13 in a monorepo managed with the Dart workspace and Melos 7.
+AlteriOne is a personal universal assistant: one runtime with three modes (`chat`, `task`, `resident`), extensions (built-in or loaded as AOT modules), LLM providers, and LSP and MCP integrations in the MVP. It has a single owner and no multi-user mode. The stack is Dart 3.13 in a monorepo managed with the Dart workspace and Melos 8.
 
 ## Invariants (never break)
 
@@ -32,6 +32,8 @@ Before M0, `dart pub get` in the root is enough. After M0, the Melos scripts def
 - `melos run test`: tests;
 - `melos run ci`: all of the above.
 
+Melos is run through the workspace lock via `dart run melos` (no global install).
+
 ## Reading map
 
 Before a task, open `docs/spec/index.md` and find the row for your task. Then read the `AGENTS.md` of the directory you work in. Read only the spec files you need; the rest waste context.

CONTRIBUTING.md

@@ -25,7 +25,9 @@ Do not silently invent decisions that are missing from the spec: write the quest
 
 ## Development setup
 
-Requirements: Dart `^3.13.0` (a [Flutter](https://flutter.dev) SDK `3.47+` provides it), Melos 7.
+Requirements: Dart `^3.13.0` (a [Flutter](https://flutter.dev) SDK `3.47+` provides it), Melos 8.
+
+Melos is run through the workspace lock via `dart run melos` (no global install).
 
 ```sh
 flutter pub get        # one resolution for the whole workspace

README.md

@@ -31,7 +31,7 @@ Distinctive decisions (each recorded in `docs/adr/` and `docs/spec/`):
 
 ## Repository layout
 
-One Dart workspace (one `pubspec.lock`, shared resolution) plus Melos. Packages prefixed `alteri_one_` are published to pub.dev; the rest are marked `publish_to: none`.
+One Dart workspace (lock file generated, not committed, shared resolution) plus Melos. Packages prefixed `alteri_one_` are published to pub.dev; the rest are marked `publish_to: none`.
 
 | Path | Package | Purpose |
 |---|---|---|
@@ -60,12 +60,12 @@ One Dart workspace (one `pubspec.lock`, shared resolution) plus Melos. Packages
 
 ## Getting started
 
-Requirements: [Dart](https://dart.dev) `^3.13.0` (a Flutter SDK gives you Dart; the client also needs [Flutter](https://flutter.dev) `3.47+`), and [Melos](https://pub.dev/packages/melos) 7.
+Requirements: [Dart](https://dart.dev) `^3.13.0` (a Flutter SDK gives you Dart; the client also needs [Flutter](https://flutter.dev) `3.47+`), and [Melos](https://pub.dev/packages/melos) 8.
 
 ```sh
 git clone https://github.com/dip-develop/alteri-one.git
 cd alteri-one
-flutter pub get          # resolves the whole workspace, one lock file
+flutter pub get          # resolves the whole workspace, lock file generated, not committed
 melos run format         # formatting
 melos run analyze        # analyzer with fatal infos
 melos run arch           # dependency rules (tools/arch_check)

docs/adr/0011-melos-8-dependency-upgrade.md

@@ -0,0 +1,26 @@
+# 0011. Melos 8 tooling line, lock file removal, and CI rewrite
+
+- Status: Accepted
+- Date: 2026-10-20
+
+## Context
+
+The Melos 7 global install is broken on the current toolchain, and the committed `pubspec.lock` keeps producing stale resolution diffs. The `build_runner` line is capped below 2.17.0 because of `injectable_generator` (build 4), and `openai_dart` stays on 8 because of `genkit_openai`. The scaffold originally pinned Melos 7 everywhere and committed a single root lock file; the Melos 7 scripts (`melos exec -c ...`) also need re-verification against the 8.x syntax.
+
+## Decision
+
+Upgrade the tooling to Melos 8.9.0 and run it through the workspace lock with `dart run melos` (no global install). Remove `pubspec.lock` from version control and add it to `.gitignore`; the lock file is generated on demand. Rewrite the CI workflow from scratch using `dart run melos run ci --no-select`. Keep `build_runner <2.17.0` because of the `injectable_generator` build 4 ceiling, and keep `openai_dart` 8 because of `genkit_openai`. The root `pubspec.yaml` carries the `melos:` configuration and the updated `melos.scripts` (Melos 8 forms: `run`/`exec` with `command`/`concurrency`/`packageFilters`, and `dependsOn` for `ci`). Update sections 4 and 5.2 of `docs/spec/architecture.md` accordingly.
+
+Q2 and T12 are resolved by this ADR.
+
+## Alternatives
+
+- Stay on Melos 7: rejected, the global install is broken and the 7.x script syntax is the unverified path.
+- Restore PR #36 (the previous Melos 8 attempt): rejected; that attempt was reverted and is superseded by this one, which rewrites CI from scratch.
+
+## Consequences
+
+- All documentation and configuration now reference Melos 8; contributors run `dart run melos` instead of a global binary.
+- The repository no longer commits a lock file; contributors run `dart pub get`/`flutter pub get` to regenerate it.
+- `build_runner` and `openai_dart` ceilings remain in place until the upstream generators/providers are updated; tracked as open constraints, not as blockers.
+- `docs/spec/open-questions.md` Q2 and `docs/spec/open-questions.md` T12 are marked resolved/closed.

docs/plan/M0.md

@@ -5,8 +5,8 @@
 - ADR: —
 
 ## Acceptance criteria
-- [x] Workspace with globs, one `pubspec.lock`, `resolution: workspace` in every member
-- [x] Melos configured in the root `pubspec.yaml` (no `melos.yaml`), scripts: `format`, `analyze`, `gen`, `arch`, `test`, `ci`
+- [x] Workspace with globs, lock file generated, not committed, `resolution: workspace` in every member
+- [x] Melos configured in the root `pubspec.yaml` (no `melos.yaml`), scripts: `format`, `analyze`, `gen`, `arch`, `test`, `ci` (Melos 8)
 - [x] Shared `analysis_options.yaml` included by every member
 - [x] All workspace members exist with pubspecs, stub libraries, and metadata; no functional implementation
 - [x] `melos run ci` is green (stubs only)
@@ -29,7 +29,7 @@
 ## Open checks [VERIFY]
 - [x] T2 partially resolved: `genkit 1.0.0` requires `schemantic ^1.0.0`, so the workspace is pinned to schemantic 1.0, not 0.2.x (see `open-questions.md`, Q1)
 - [ ] T2: schemantic 1.0.0 annotations on SDK 3.13
-- [ ] T12: `melos.scripts` syntax and `melos exec` flags in Melos 7.8.x (see `open-questions.md`, Q2 on Melos 8)
+- [x] T12: `melos.scripts` syntax and `melos exec` flags in Melos 8.9.0 (see `open-questions.md`, Q2) — closed
 
 ## Outcome
-Scaffold created on 2026-10-17: 22 workspace members, root workspace + Melos 7 config, community files. Spikes and the three tools remain.
+Scaffold created on 2026-10-17: 22 workspace members, root workspace + Melos 8 config, community files. Spikes and the three tools remain.

docs/spec/architecture.md

@@ -9,8 +9,8 @@ Minimum versions as of the date of writing. Check the current version on pub.dev
 | Component | Minimum | Notes |
 |---|---|---|
 | Dart SDK | `^3.13.0` | fixed |
-| Dart workspace | globs in `workspace:` | globs since Dart 3.11; one `pubspec.lock` at the root |
-| Melos | 7.x | configured in the root `pubspec.yaml`; `melos.yaml` is not used [VERIFY current version] |
+| Dart workspace | globs in `workspace:` | globs since Dart 3.11; lock file is generated and not committed |
+| Melos | 8.x | configured in the root `pubspec.yaml`; `melos.yaml` is not used; run via `dart run melos` from the workspace lock |
 | bloc | `^9.2.0` | pure Dart. `flutter_bloc` only in the client |
 | bloc_concurrency | current | `sequential`, `droppable`, `restartable`, `concurrent` |
 | bloc_test | current | state tests [VERIFY compatibility with bloc 9] |
@@ -23,24 +23,24 @@ Minimum versions as of the date of writing. Check the current version on pub.dev
 | genkit_a2ui | not used in the MVP | outside the MVP |
 | dotprompt | `^2.0.0` | `.prompt` files with JSON Schema in the frontmatter |
 | handlebars_dart | through dotprompt | no separate dependency unless custom helpers are needed |
-| schemantic | `0.2.x` line | compatible with genkit packages. Do not use `1.0.0-rc.1` until verified [VERIFY] |
+| schemantic | `^1.0.0` | stable release; matches genkit (`genkit: ^1.0.0`) |
 | hive_ce | current | `Box` and `LazyBox` |
 | shelf | current | HTTP and HTTPS through `securityContext` [VERIFY signature] |
 | injectable | current | DI in `core` and `app`, environments `dev`, `prod`, `test` |
-| build_runner | current | code generation for schemantic and injectable |
+| build_runner | current | code generation for schemantic and injectable; ceiling `<2.17.0` due to `injectable_generator` (build 4) |
 | yaml | current | configuration parsing |
 | http | current | client in `alteri_one_client` and providers |
 
 All workspace members resolve together. Version conflicts appear immediately. Keep one schemantic line across the workspace and run `dart pub outdated` after every addition.
 
 ## 5. Repository layout
 
-The monorepo is one Dart workspace (one `pubspec.lock`, shared dependency resolution) plus Melos 7 (scripts, filtering, versions, publishing). Packages are grouped by purpose and by publishing rules, not by technology.
+The monorepo is one Dart workspace (lock file generated, not committed, shared dependency resolution) plus Melos 8 (scripts, filtering, versions, publishing). Packages are grouped by purpose and by publishing rules, not by technology.
 
 ```
 alteri-one/
 ├── pubspec.yaml                 # workspace root and Melos configuration (melos:, melos.scripts)
-├── pubspec.lock                 # one lock file for the whole workspace
+├── pubspec.lock                 # generated, not committed
 ├── analysis_options.yaml        # shared lint rules, included by each member
 │
 ├── packages/                    # public pub.dev libraries (semver, changelog)
@@ -100,7 +100,7 @@ alteri-one/
 
 ### 5.2 Melos configuration
 
-Melos 7 reads its settings from the root `pubspec.yaml`. There is no separate `melos.yaml`. Scripts are declared in `melos.scripts`.
+Melos 8 reads its settings from the root `pubspec.yaml`. There is no separate `melos.yaml`. Scripts are declared in `melos.scripts`. Melos is run through the workspace lock via `dart run melos` (no global install). T12 is closed: Melos 8 syntax verified against 8.9.0.
 
 ```yaml
 # pubspec.yaml (root)
@@ -117,18 +117,38 @@ workspace:
   - e2e
   - tools/*
 dev_dependencies:
-  melos: ^7.0.0                    # [VERIFY current version on pub.dev]
+  melos: ^8.9.0
 melos:
   scripts:
-    analyze: melos exec -c 1 -- dart analyze --fatal-infos
-    test: melos exec -c 4 --dir-exists=test -- dart test
-    format: dart format --set-exit-if-changed .
-    gen: melos exec -c 1 --depends-on build_runner -- dart run build_runner build --delete-conflicting-outputs
-    arch: dart run tools/arch_check/bin/arch_check.dart
-    ci: melos run format && melos run analyze && melos run arch && melos run test
+    format:
+      run: dart format --set-exit-if-changed .
+    analyze:
+      exec:
+        command: dart analyze --fatal-infos
+        concurrency: 1
+    gen:
+      exec:
+        command: dart run build_runner build --delete-conflicting-outputs
+        concurrency: 1
+      packageFilters:
+        dependsOn: build_runner
+    arch:
+      run: dart run tools/arch_check/bin/arch_check.dart
+    test:
+      exec:
+        command: dart test
+        concurrency: 4
+      packageFilters:
+        dirExists: test
+    ci:
+      dependsOn:
+        - format
+        - analyze
+        - arch
+        - test
 ```
 
-[VERIFY: syntax of `melos.scripts`, composite scripts, and `melos exec` flags in the selected Melos 7 version.]
+[VERIFY T12 closed: Melos 8 syntax verified against 8.9.0.]
 
 Versions and publishing: `melos version` uses conventional commits for `packages/`, `providers/`, and `extensions/`. Publishing follows the dependency order. Packages with `publish_to: none` are never published.
 

docs/spec/forbidden-glossary.md

@@ -12,7 +12,7 @@ Do not use anything listed here, even if you find it in old examples, articles,
 | MCP stdio as the extension transport | replaced by AOT modules and built-in mode | `Isolate.spawnUri` behind `ExtensionTransport`, or built-in mode |
 | `alterione-sdk` as the only package | replaced by a set of packages | `alteri_one_*` |
 | `alterione_*` as a package prefix | corrected | `alteri_one_*` |
-| `melos.yaml` and `pubspec_overrides.yaml` | Melos 7 and pub workspaces | root `pubspec.yaml` with `workspace:` and `melos:` |
+| `melos.yaml` and `pubspec_overrides.yaml` | Melos 8 and pub workspaces | root `pubspec.yaml` with `workspace:` and `melos:` |
 | Node.js or npm as the agent runtime | project decision | Dart, native binary |
 | Multi-user mode, accounts, tenants | out of scope: a personal assistant | one owner, devices with tokens |
 | `sqlite`, `drift` | replaced | Hive CE |

docs/spec/open-questions.md

@@ -9,7 +9,7 @@ Added during the M0 scaffold (2026-10-17). Until answered, the scaffold takes th
 | ID | Question | Conservative choice taken |
 |---|---|---|
 | Q1 | schemantic line: the spec pins 0.2.x ("do not use 1.0.0-rc.1 until verified"), but `genkit 1.0.0` declares `schemantic: ^1.0.0`, so 0.2.x cannot coexist with genkit in one workspace, and schemantic 1.0.0 is now a stable release. Confirm the move to the 1.0.0 line and update section 4. | pinned `schemantic: ^1.0.0` everywhere |
-| Q2 | Melos line: the spec pins Melos 7 everywhere; Melos 8.x is the current pub.dev release. Migrate to 8 and update sections 4 and 5.2? [VERIFY T12] covers script syntax on 7.x. | pinned `melos: ^7.0.0` (resolves 7.8.2) |
+| Q2 | ~~Melos line: the spec pins Melos 7 everywhere; Melos 8.x is the current pub.dev release. Migrate to 8 and update sections 4 and 5.2? [VERIFY T12 closed] covers script syntax on 7.x.~~ Resolved 2026-10-20: migrated to Melos 8.9.0; sections 4 and 5.2 updated. | pinned `melos: ^8.9.0` (resolves 8.9.0) |
 | Q3 | `tools/docs_check` is required by `docs/spec/index.md` ("Rules for maintaining documents") but is missing from the repository layout in `docs/spec/architecture.md`, section 5. Add it to section 5? | scaffolded `tools/docs_check` |
 | Q4 | ~~Repository URL: the spec gives the repository name `alteri-one` but not the GitHub owner.~~ Resolved 2026-10-17: the owner is `dip-develop`; all pubspecs and docs use `https://github.com/dip-develop/alteri-one`. | resolved |
 | Q5 | `public_member_api_docs` cannot coexist with the primary-constructor style mandated by section 7.2: the Dart 3.13.5 analyzer does not attach `///` comments to primary-constructor parameters (the style used by every example in `domain.md` section 8). Re-enable the lint when the analyzer supports parameter docs. Until then, parameter dartdoc stays mandatory by convention; `packages/AGENTS.md` ("public classes and methods have English dartdoc") is enforced in review, not by the analyzer. | lint omitted from the shared set; docs kept by convention |
@@ -34,7 +34,7 @@ T1 is closed (ADR-0007). T14 is closed: the `RunBloc` suite in `alteri_one_core`
 | T9 | `hive_ce` API names (`openLazyBox`, encryption) | M0 | adjust the adapter |
 | T10 | the `SKILL.md` format in `genkit_middleware` | M5 | a custom parser |
 | T11 | the `dart build cli` command on Dart 3.13 for each OS | M4 | `dart compile exe` |
-| T12 | `melos.scripts` syntax, composite scripts, `melos exec` flags | M0 | fix the root `pubspec.yaml` |
+| T12 | ~~`melos.scripts` syntax, composite scripts, `melos exec` flags~~ Closed 2026-10-20: Melos 8 syntax verified against 8.9.0. | M0 | done |
 | T13 | the `shelf_io.serve` signature with `securityContext` | M4b | a TLS proxy in front of the daemon |
 | T14 | `bloc_test` compatibility with bloc 9 | M2 | test transitions as pure functions |
 | T15 | `StatePublisher` queue limits and overflow behavior | M5 | tune limits per topic |

docs/spec/product.md

@@ -9,12 +9,12 @@
 | Name | AlteriOne |
 | Purpose | personal universal assistant: `chat`, `task`, and `resident` modes in one runtime |
 | Domain | https://alteri.one |
-| Repository | `alteri-one`, monorepo: Dart workspace and Melos 7 |
+| Repository | `alteri-one`, monorepo: Dart workspace and Melos 8 |
 | Dart packages | prefix `alteri_one_*` |
 | Binary | `alterione` (core and CLI). Personal builds get their own names |
 | License | Apache-2.0 |
 | Dart SDK | `^3.13.0` |
-| Build and tasks | Dart pub workspace (dependency resolution) and Melos 7 (scripts, versions, publishing) |
+| Build and tasks | Dart pub workspace (dependency resolution) and Melos 8 (scripts, versions, publishing) |
 | Website | Jaspr, SSR |
 | Configuration | YAML, schema from schemantic |
 | User model | one owner per instance, several devices of the owner; no accounts, no multi-user mode |

docs/spec/roadmap.md

@@ -14,7 +14,7 @@ Each milestone ends with a green `melos run ci`, updated documents (if decisions
 
 | Milestone | Scope | In MVP |
 |---|---|---|
-| M0 | Skeleton: workspace with globs, Melos 7, `analysis_options.yaml`, `tools/arch_check`, `tools/codegen_check`, `tools/docs_check`, CI. Spikes: schemantic, Hive (`kill -9`, `flush`), llama-server, Melos syntax, `dart language-server`, `mcp_dart`, keyring libraries | yes |
+| M0 | Skeleton: workspace with globs, Melos 8, `analysis_options.yaml`, `tools/arch_check`, `tools/codegen_check`, `tools/docs_check`, CI. Spikes: schemantic, Hive (`kill -9`, `flush`), llama-server, Melos syntax, `dart language-server`, `mcp_dart`, keyring libraries | yes |
 | M1 | Contracts: `alteri_one_contracts`, `alteri_one_provider_api`, `alteri_one_sdk`, `alteri_one_client`, state projection types, golden tests | yes |
 | M2 | Domain and loop: `transition`, `PolicyGate` with taints and rights, journal, `RunBloc`, loop with a fake `LlmPort`, `chat` mode. Target metrics measured (section 2.8) | yes |
 | M3 | llama.cpp provider: adapter over `genkit_openai`, probe, conformance. Adapter decision recorded as an ADR | yes |