feat(project): make Work Item execution durable across providers and routines

.github/workflows/release.yaml

@@ -168,6 +168,9 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
           ORGII_APP_VERSION: ${{ env.SEMVER }}
+          ORGII_BUILD_KIND: release
+          ORGII_BUILD_REF: ${{ github.ref_name }}
+          ORGII_BUILD_SHA: ${{ github.sha }}
         run: pnpm tauri build --target aarch64-apple-darwin
 
       # ── Locate build artifacts ────────────────────────────────
@@ -318,6 +321,9 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
           ORGII_APP_VERSION: ${{ env.SEMVER }}
+          ORGII_BUILD_KIND: release
+          ORGII_BUILD_REF: ${{ github.ref_name }}
+          ORGII_BUILD_SHA: ${{ github.sha }}
         run: pnpm tauri build --target x86_64-pc-windows-msvc --bundles ${{ env.WIN_BUNDLES }}
 
       # ── Sign with Azure Trusted Signing ─────────────────────────
@@ -532,6 +538,9 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           ORGII_DIAGNOSTICS_TOKEN: ${{ secrets.ORGII_DIAGNOSTICS_TOKEN }}
           ORGII_APP_VERSION: ${{ env.SEMVER }}
+          ORGII_BUILD_KIND: release
+          ORGII_BUILD_REF: ${{ github.ref_name }}
+          ORGII_BUILD_SHA: ${{ github.sha }}
         run: pnpm tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage
 
       # ── Gather artifacts ─────────────────────────────────────────

docs/frontend-ui-audit-2026-08-08/WorkItemContent.md

@@ -0,0 +1,28 @@
+# Work Item Content UI audit
+
+Scope: the Work Item Discussion, custom properties, subscription, and PR readiness UI changed by `codex/durable-workitem-runs`.
+
+## Verdict
+
+- Fix: 6
+- Keep with reason: 3
+- Abstract: 0
+
+## Fixed
+
+1. Typed property controls use the shared `Input`, `Select`, `Checkbox`, `Button`, and `InlineAlert` components.
+2. Removed the custom arbitrary grid-template value from property rows in favor of standard flex sizing utilities.
+3. Discussion actions are real shared buttons with accessible labels and native keyboard behavior.
+4. Resolve, reopen, and reply controls are hidden when their callback is unavailable, so read-only views do not expose dead actions.
+5. New user-facing labels use translation keys with English fallback text.
+6. Loading, empty, error, resolved, conclusion, and reply states have visible text in addition to icons or color.
+
+## Kept with reason
+
+1. Avatar colors remain inline CSS variables because member colors are runtime data, not fixed design tokens.
+2. `<time>` remains a native element because it carries the correct document semantics and has no design-system replacement.
+3. Existing compact `text-[11px]`, `text-[12px]`, and `text-[13px]` utilities in the surrounding Work Item output/history surfaces remain unchanged to preserve their established dense layout; the new custom-properties surface uses standard `text-xs` and `text-sm` sizes.
+
+## Abstraction review
+
+No new cross-surface abstraction is warranted. Discussion threads are specific to Work Item history, while typed value editors are intentionally colocated with the Work Item custom-properties section. Shared primitives are reused at the component boundary.

src-tauri/Cargo.toml

@@ -204,6 +204,10 @@ tauri-plugin-webdriver-automation = { version = "0.1", optional = true }
 portable-pty = "0.9"
 tokio = { workspace = true }
 uuid = { version = "1", features = ["v4"] }
+flate2 = "1"
+tar = "0.4"
+plist = "1"
+tempfile = "3.13"
 
 # Shared cross-crate type definitions (Phase 1 of workspace migration).
 # See `docs/rust-backend/modularization-plan--0504.md`.
@@ -556,7 +560,6 @@ foreign-types = "0.5"   # ForeignType trait used by core-graphics types
 tauri-plugin-updater = "=2.9.0"
 
 [dev-dependencies]
-tempfile = "3.13"
 
 # `test-util` only for the test build: it is what lets a test drive Tokio's
 # clock (`#[tokio::test(start_paused = true)]`) rather than really sleeping out

src-tauri/build.rs

@@ -10,6 +10,7 @@
 use std::env;
 use std::fs;
 use std::path::{Path, PathBuf};
+use std::process::Command;
 
 const OPTIONAL_SIDECAR_PLACEHOLDER_MARKER: &str = "ORGII_GENERATED_OPTIONAL_SIDECAR_PLACEHOLDER";
 
@@ -21,6 +22,7 @@ fn main() {
     let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("CARGO_MANIFEST_DIR"));
     ensure_optional_sidecar_resources(&manifest_dir);
     configure_windows_main_stack();
+    configure_build_provenance(&manifest_dir);
 
     tauri_build::build();
 
@@ -41,6 +43,80 @@ fn main() {
     });
 }
 
+/// Stamp one authoritative build identity into the native binary.
+///
+/// Official release workflows must opt in with `ORGII_BUILD_KIND=release`.
+/// Every other build is local by default, which is the fail-safe choice for
+/// update installation: an unclassified artifact must never replace itself
+/// with a published release.
+fn configure_build_provenance(manifest_dir: &Path) {
+    for key in ["ORGII_BUILD_KIND", "ORGII_BUILD_REF", "ORGII_BUILD_SHA"] {
+        println!("cargo:rerun-if-env-changed={key}");
+    }
+
+    let kind = match env::var("ORGII_BUILD_KIND").ok().as_deref() {
+        Some("release") => "release",
+        Some("local") | None => "local",
+        Some(value) => panic!("unsupported ORGII_BUILD_KIND: {value}"),
+    };
+    let git_ref = env::var("ORGII_BUILD_REF")
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+        .or_else(|| git_output(manifest_dir, &["symbolic-ref", "--short", "HEAD"]))
+        .or_else(|| git_output(manifest_dir, &["describe", "--tags", "--exact-match"]))
+        .unwrap_or_else(|| "unknown".to_string());
+    let git_sha = env::var("ORGII_BUILD_SHA")
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+        .or_else(|| git_output(manifest_dir, &["rev-parse", "HEAD"]))
+        .unwrap_or_else(|| "unknown".to_string());
+
+    println!(
+        "cargo:rustc-env=ORGII_BUILD_KIND={}",
+        sanitize_rustc_env(kind)
+    );
+    println!(
+        "cargo:rustc-env=ORGII_BUILD_REF={}",
+        sanitize_rustc_env(&git_ref)
+    );
+    println!(
+        "cargo:rustc-env=ORGII_BUILD_SHA={}",
+        sanitize_rustc_env(&git_sha)
+    );
+
+    for git_path in [
+        git_output(manifest_dir, &["rev-parse", "--git-path", "HEAD"]),
+        git_output(manifest_dir, &["rev-parse", "--git-path", "packed-refs"]),
+        git_output(
+            manifest_dir,
+            &["rev-parse", "--git-path", &format!("refs/heads/{git_ref}")],
+        ),
+    ]
+    .into_iter()
+    .flatten()
+    {
+        println!("cargo:rerun-if-changed={git_path}");
+    }
+}
+
+fn git_output(manifest_dir: &Path, args: &[&str]) -> Option<String> {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(manifest_dir)
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let value = String::from_utf8(output.stdout).ok()?;
+    let value = value.trim();
+    (!value.is_empty()).then(|| value.to_string())
+}
+
+fn sanitize_rustc_env(value: &str) -> String {
+    value.replace(['\r', '\n'], " ")
+}
+
 /// The generated Tauri invoke handler and setup closure share the Windows
 /// process main thread. The PE default reserves only 1 MiB, which is too
 /// narrow for debug builds as the command registry grows and can terminate