Consolidate salvaged branches: signal_mesh + MCP↔WS bridge + pomodoro demo, green CI with per-package coverage ratchet (#57)

## TLDR
Consolidates all useful work salvaged from the repo's stray branches
onto one branch — two new packages (`signal_mesh`,
`mcp-websocket-bridge`), a pomodoro demo across the examples, CI/tooling
hardening — and gets `make ci` fully green with per-package coverage
that auto-ratchets up.

## What Was Added?
- **`signal_mesh/`** — new Dart package: peer-to-peer encrypted mesh
messenger. Kademlia DHT peer discovery, X3DH + Double Ratchet end-to-end
crypto, phone-number identity + attestation, store-and-forward queue,
and a transport abstraction. Ships its own test suite (crypto, node_id,
kademlia, routing_table, identity, message, store_forward, transport).
`publish_to: none` (path deps on `dart_node_core`/`dart_node_ws`).
- **`packages/mcp-websocket-bridge/`** — new TypeScript package bridging
MCP over WebSocket (bridge/transport/session/http-client/types/errors),
with `SPEC.md`, README, and an `examples/chat-bridge.ts`.
- **Pomodoro demo** across `examples/` — backend routes +
`PomodoroService` + validation schema, mobile `pomodoro_screen`, shared
`PomodoroSession` model / theme styles / HTTP client, plus backend and
mobile tests. Also a `paper_demo_screen` (react-native-paper).
- **Agent/dev tooling** — `.claude/skills/*` (build, ci-prep,
code-dedup, fix-bug, fmt, lint, spec-check, submit-pr, upgrade-packages,
website-audit), assistant rule files (`.cursorrules`, `.clinerules`,
`.windsurfrules`, copilot-instructions), `.deslop.toml`,
`.editorconfig`.
- **`coverage-thresholds.json`** — single source of truth for
per-package coverage floors that ratchet UP only.

## What Was Changed or Deleted?
- **Coverage now actually enforced.** `coverage-thresholds.json` was a
single `default_threshold: 70`. It now carries a per-package map seeded
from the legacy GitHub Actions variable `MIN_COVERAGE=70` and
**auto-ratcheted** in `tools/test.sh`: after every fully-green run each
package's floor is raised to its measured coverage and never lowered
(`default_threshold` raised to a 90% library floor for new packages).
- **`make ci` made green** (these were real pre-existing failures, not
introduced here):
- `packages/dart_node_coverage/lib/src/runtime.dart` — removed all
illegal `as` casts and a bare `catch`; replaced with typed `@JS`
extension types (`JSON.parse`, `Object.keys`) and generic
`getProperty<T>`.
- `examples/backend/server.dart` — the pomodoro routes were a broken
merge (missing `models/pomodoro.dart` import; calling an undefined
`getAuthContext`; unmatched `Result`s). Rewrote all 10 routes to the
same `getAuthContextWithService` + `getValidatedBody` pattern the task
routes use.
- `dart_node_mcp` / `dart_node_vsix` / `dart_node_ws` test files —
cascades, the JSArray `prefer_is_empty` false-positive
(`.toDart.isNotEmpty`), `unnecessary_async`, a tearoff, nullable-cast
cleanup.
- `cspell-dictionary.txt` — added the legitimate technical terms cspell
flagged (Kademlia, HKDF/HMAC, ciphertext, otpk, prekey, pomodoro,
deslop, worktree, automemory).
- **Removed `tools/build/`** (`build.dart`, `add_preamble.dart`) —
superseded.
- `analysis_options.yaml` tightened
(`strict-casts`/`strict-inference`/`strict-raw-types`); `Makefile`
standardized (`lint`/`test`/`fmt`/`ci`); `.github/workflows/` updated
(CI reads the coverage threshold from the JSON; `deploy-website` →
`deploy-pages`); website gained pub.dev + GitHub links and a
getting-started page.

## How Do The Automated Tests Prove It Works?
- `make ci` is **green end-to-end** (`MAKE_CI_EXIT=0`): cspell reports
`0 issues in 0 files`; `dart analyze` reports **0 errors** across every
package and example; all test tiers pass with coverage enforced —
`dart_node_core`/`dart_node_ws`/`dart_node_express`/`dart_node_better_sqlite3`/`dart_node_mcp`/`dart_node_react_native`/`dart_logging`
at 100%, `web_counter` 98.5%, `reflux` 97.6%, `markdown_editor` 94.8%;
`dart_node_react`/`frontend` browser tests pass under Chrome.
- **Ratchet verified across two runs:** run #1 logged `⬆️ Ratcheted … →
100.0% (was 70%)` for every package and `Coverage thresholds raised`;
run #2 produced **no** ratchet lines and still passed — proving the
floor is monotonic and idempotent. A subsequent coverage drop below the
stored floor now fails `make test`.
- The `runtime.dart` refactor is exercised at runtime, not just
statically: the Node coverage CLI uses `writeCoverageFile`/`_mergeData`
to merge coverage for every `NODE_PACKAGES` run, all of which passed.

## Spec / Doc Changes
- `CLAUDE.md` — TDD rule + deslop / branch-discipline / autonomy /
auto-memory sections.
- `coverage-thresholds.json` `_doc` rewritten to describe the
auto-ratchet contract.
- New `signal_mesh/README.md` and `mcp-websocket-bridge/SPEC.md` +
README.

## Breaking Changes
- [x] None to any published package surface. The two new packages are
not published (`publish_to: none` / path deps); all other changes are
examples, CI/tooling, and lint-clean refactors with no behavioral
change.

> Note: `signal_mesh` and `mcp-websocket-bridge` ship with their own
tests but are not yet wired into the `tools/test.sh` tier runner, so
they are not gated by `make ci` in this PR — a sensible follow-up.

---------

Author: MelbourneDeveloper

.claude/settings.json

@@ -0,0 +1,4 @@
+{
+  "_agent_pmo": "76596cb",
+  "autoMemoryEnabled": false
+}

.claude/skills/build/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: build
+description: Builds all artifacts for this repo. Use when the user asks to build, compile, or produce artifacts, or when verifying that the project compiles cleanly.
+---
+
+# Build
+
+Build all artifacts for this repo.
+
+## Steps
+
+1. Run `make clean` to remove stale artifacts
+2. Run `make build`
+3. Report what was built and where the artifacts are
+
+## Notes
+
+This is a Dart library monorepo — `make build` verifies that all packages compile cleanly. There are no standalone build artifacts (libraries are consumed via pub.dev).
+
+To build specific components:
+- Backend example: `dart run tools/build/build.dart backend`
+- VS Code extension: see `/build-extension` skill
+
+## Success criteria
+
+- Exit code 0 from `make build`
+- No warnings printed to stderr

.claude/skills/ci-prep/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: ci-prep
+description: Prepares the current branch for CI by running the exact same checks locally, fixing issues at each step. Use before pushing a branch or when the user wants to verify the branch will pass CI.
+---
+
+# CI Prep
+
+Prepare the current state for CI. Ensures the branch will pass CI before pushing.
+
+## Steps
+
+### Step 1 — Analyze the CI workflow
+
+1. Read `.github/workflows/ci.yml`
+2. The CI runs these jobs in order:
+   - **lint**: format check, spell check, dart analyze
+   - **test**: tier 1, tier 2, tier 3 tests with coverage
+   - **build**: `make build`
+   - **website**: website build + Playwright tests (independent)
+
+### Step 2 — Run each CI step locally, in order
+
+1. **Format check**: `make fmt CHECK=1`
+   - If fails: run `make fmt` to fix, then re-check
+2. **Spell check**: `cspell "**/*.md" "**/*.dart" "**/*.ts" --no-progress`
+   - If fails: add words to cspell dictionary or fix typos
+3. **Analyze**: `dart analyze --no-fatal-warnings` on all packages
+   - If fails: fix lint errors in the reported files
+4. **Test Tier 1**: `./tools/test.sh --tier 1`
+5. **Test Tier 2**: `./tools/test.sh --tier 2`
+6. **Test Tier 3**: `./tools/test.sh --tier 3`
+7. **Build**: `make build`
+
+### Step 3 — Report
+
+- List every step that was run and its result (pass/fail/fixed)
+- If any step could not be fixed, report what failed and why
+- Confirm whether the branch is ready to push
+
+## Rules
+
+- Do not push if any step fails
+- Fix issues found in each step before moving to the next
+- Never skip steps or suppress errors

.claude/skills/code-dedup/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: code-dedup
+description: Searches for duplicate code, duplicate tests, and dead code, then safely merges or removes them. Use when the user says "deduplicate", "find duplicates", "remove dead code", "DRY up", or "code dedup". Requires test coverage — refuses to touch untested code.
+---
+
+# Code Dedup
+
+Carefully search for duplicate code, duplicate tests, and dead code across the repo. Merge duplicates and delete dead code — but only when test coverage proves the change is safe.
+
+## Prerequisites — hard gate
+
+Before touching ANY code, verify these conditions. If any fail, stop and report why.
+
+1. Run `make test` — all tests must pass. If tests fail, stop.
+2. `make test` already enforces the coverage threshold from `coverage-thresholds.json`. If it failed on coverage, stop.
+3. This is a Dart repo with static typing via `austerity` — proceed.
+
+## Steps
+
+### Step 1 — Inventory test coverage
+
+1. Run `make test` and note coverage per package from the output
+2. Only packages WITH coverage are candidates for dedup
+
+### Step 2 — Scan for dead code
+
+1. Look for unused exports, functions, classes, variables across all packages
+2. Use `dart analyze` output for unused element warnings
+3. Grep the entire codebase for references before marking as dead
+4. List all dead code found. Do NOT delete yet.
+
+### Step 3 — Scan for duplicate code
+
+1. Look for functions with identical or near-identical logic across packages
+2. Check across package boundaries
+3. List all duplicates found. Do NOT merge yet.
+
+### Step 4 — Scan for duplicate tests
+
+1. Look for tests that verify the same behavior
+2. Look for test helpers duplicated across test files
+3. List all duplicate tests found. Do NOT delete yet.
+
+### Step 5 — Apply changes (one at a time)
+
+For each change: **change -> test -> verify coverage -> continue or revert**.
+
+- After each change: run `./tools/test.sh`
+- If tests fail or coverage drops: **revert immediately**
+
+### Step 6 — Final verification
+
+1. Run `make test` — all tests must still pass
+2. Run `make lint` and `make fmt CHECK=1` — code must be clean
+3. Report: what was removed, what was merged, final coverage vs baseline
+
+## Rules
+
+- **No test coverage = do not touch.**
+- **Coverage must not drop.**
+- **One change at a time.**
+- **When in doubt, leave it.** False dedup is worse than duplication.
+- **Three similar lines is fine.** Only dedup substantial (>10 lines) or 3+ copies.

.claude/skills/fix-bug/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: fix-bug
+description: Fix a bug using test-driven development. Use when the user reports a bug, describes unexpected behavior, wants to fix a defect, or says something is broken. Enforces a strict test-first workflow where a failing test must be written and verified before any fix is attempted.
+argument-hint: "[bug description]"
+allowed-tools: Read, Grep, Glob, Edit, Write, Bash
+---
+<!-- agent-pmo:76596cb -->
+
+# Bug Fix Skill — Test-First Workflow
+
+You MUST follow this exact workflow. Do NOT skip steps. Do NOT fix the bug before writing a failing test.
+
+## Step 1: Understand the Bug
+
+- Read the bug description: $ARGUMENTS
+- Investigate the codebase to understand the relevant code
+- Identify the root cause (or narrow down candidates)
+- Summarize your understanding of the bug to the user before proceeding
+
+## Step 2: Write a Failing Test
+
+- Write a test that **directly exercises the buggy behavior**
+- The test must assert the **correct/expected** behavior — so it FAILS against the current broken code
+- The test name should clearly describe the bug (e.g., `test_orange_color_not_applied_to_head`)
+- Use the project's existing test framework and conventions
+
+## Step 3: Run the Test — Confirm It FAILS
+
+- Run ONLY the new test (not the full suite)
+- **Verify the test FAILS** and that it fails **because of the bug**, not for some other reason (typo, import error, wrong selector, etc.)
+- If the test passes: your test does not capture the bug. Go back to Step 2
+- If the test fails for the wrong reason: fix the test, not the code. Go back to Step 2
+- **Repeat until the test fails specifically because of the bug**
+
+## Step 4: Show Failure to User
+
+- Show the user the test code and the failure output
+- Explicitly ask: "This test fails because of the bug. Can you confirm this captures the issue before I fix it?"
+- **STOP and WAIT for user acknowledgment before proceeding**
+- Do NOT continue to Step 5 until the user confirms
+
+## Step 5: Fix the Bug
+
+- Make the **minimum change** needed to fix the bug
+- Do not refactor, clean up, or "improve" surrounding code
+- Do not change the test
+
+## Step 6: Run the Test — Confirm It PASSES
+
+- Run the new test again
+- **Verify it PASSES**
+- If it fails: go back to Step 5 and adjust the fix
+- **Repeat until the test passes**
+
+## Step 7: Run the Full Test Suite
+
+- Run ALL tests to make sure nothing else broke
+- If other tests fail: fix the regression without breaking the new test
+- Report the final result to the user
+
+## Rules
+
+- NEVER fix the bug before the failing test is written and confirmed
+- NEVER skip asking the user to acknowledge the test failure
+- NEVER modify the test to make it pass — modify the source code
+- If you cannot write a test for the bug, explain why and ask the user how to proceed
+- Keep the fix minimal — one bug, one fix, one test

.claude/skills/fmt/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: fmt
+description: Formats all code in this repo using dart format. Use when the user asks to format code, fix formatting, or before committing changes.
+---
+
+# Format
+
+Format all code in this repo.
+
+## Steps
+
+1. Run `make fmt`
+2. Run `make fmt CHECK=1` to confirm clean
+3. Report which files were modified
+
+## What it does
+
+- `dart format packages/ examples/`
+
+## Success criteria
+
+- `make fmt CHECK=1` exits with code 0 after formatting

.claude/skills/lint/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: lint
+description: Runs all linters and format checks, then fixes any issues found. Use when the user asks to lint, check code quality, or fix linting errors.
+---
+
+# Lint
+
+Run all linters and report issues.
+
+## Steps
+
+1. Run `make lint` (runs format check + cspell + dart analyze on all packages)
+2. Report all issues found (file, line, rule, message)
+3. If issues found, fix them and re-run to confirm clean
+
+## What `make lint` does
+
+1. `dart format --set-exit-if-changed` on packages/, examples/, tools/build
+2. `cspell` spell check on all .md, .dart, .ts files
+3. `dart analyze --no-fatal-warnings` on every package and example
+
+## Rules
+
+- Never suppress a lint warning with an ignore comment
+- Fix the code to satisfy the linter
+- Each package uses the `austerity` lint package — do not bypass its rules
+- If a rule seems wrong for a specific case, document why in code comments
+
+## Success criteria
+
+- `make lint` exits with code 0
+- Zero warnings or errors output