Merge V2 intelligence with the editorial compact extension

[austinintelligence]

Summary

This is the semantic merge of the clean V2 intelligence architecture with the preserved local editorial product work.

• Keeps V2's ArticleIndex → Article Lens → shared retrieval → adjudication → deterministic validation → EvidenceLedger pipeline.
• Ports the explicit Analyze flow, four research depths, editorial routes, four real progress phases, section footnotes, settings tabs, diagnostics, extraction hardening, encrypted local retention, and Free/ChatGPT/Exa provider setup.
• Keeps the one-dimensional -3…+3 political spectrum. Article framing supplies 50% of placement evidence; verified publication and journalist context share the contextual 50%.
• Preserves reconnectable journaled streaming, one stable job/run identity, partial reports, and targeted section retries.
• Adds release/package gates, policy/privacy/security documentation, GitHub Pages support/privacy content, checksums/SBOM/provenance workflows, and the optional Rust developer-channel installation helper.

Why

Remote main contained the newer V2 architecture while substantial product, UI, security, and release work existed only in an uncommitted local checkout. A direct merge would have restored deleted V1 packages and created two competing pipelines. This branch ports the local behavior onto V2's contracts and runtime instead.

The preserved local snapshot remains on codex/local-editorial-snapshot; this branch is based on remote ab50cb2.

User impact

• Research starts only after the user selects a depth and chooses Analyze article.
• Running analysis survives navigation to Settings or Diagnostics.
• Reader-visible progress comes from real V2 phases without invented percentages.
• Section failures preserve successful sections and can be retried independently.
• Provider failures fall back from ChatGPT/Exa to Free, then to article-only analysis.
• Credentials, Exa keys, retained artifacts, journals, and diagnostics remain local and encrypted where retained.
• The initial side-panel bundle is lazy-split and remains below the 260 kB gate.

Validation

• pnpm verify:release
• pnpm test: 37 files, 164 tests
• pnpm test:coverage: 55.66% statements / 65.65% branches overall
• pnpm audit --prod --audit-level=high: no known vulnerabilities
• cargo fmt --check
• cargo test --locked: 7 tests
• Release version and workflow YAML checks
• Secret scan across tracked/intended files
• Manifest/CSP/remote-code/package security checks
• Production side panel rendered at 320, 360, 420, and 520 CSS pixels with no horizontal overflow
• Unpacked MV3 smoke-tested in local Chrome and Brave profiles

Measured package results

• 1,216,425 bytes / 1.160 MiB unpacked
• 374.25 kB release ZIP
• 258.16 kB initial side-panel chunk
• 8.16 kB lazy Settings chunk
• 1.992 s WXT production build in the recorded comparison pass

Compared with the local editorial snapshot, the merged package is 49,140 bytes smaller unpacked, its initial side-panel chunk is 78.45 kB smaller, and the ZIP is 31.77 kB smaller.

Known limitations

• Microsoft Edge was not installed on the reference machine and still needs a release-channel smoke test.
• Authenticated live-provider TTFT, completion latency, memory, and CPU were not measured in this pass.
• Repository-wide branch coverage remains below the earlier aspirational 80% target.
• The Rust helper is an unsigned guided beta; it never silently installs or modifies browser policy.
• Chrome Web Store readiness is technically prepared but approval remains conditional because Login with ChatGPT uses an experimental community transport.

Detailed architecture, benchmark evidence, retention rules, permission justifications, and release instructions are included under docs/.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fff56e38-496f-4022-be10-94f4aab05487

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}