tdeverx/contained-app

Progress note from draft PR #48 at `51d9c734`: no cache implementation landed here, by design. The PR keeps runtime-owned runnable image stores and shared registry/search/update metadata, while Docker adapter support remains dormant by default.\n\nThis remains the backlog item for an optional Contained-owned OCI cache/library and explicit future load-into-runtime workflows.

Progress note from draft PR #48 at `51d9c734`: the workflow hygiene from the July audit has been folded in: repo validation now runs through `Scripts/check.sh repo`, stale path guards cover the new `Scripts/`/`Documentation/`/`Changes/` layout, and timeout/path-filter policy is documented. The latest local validation included `./Scripts/check.sh all`.\n\nStill open: Swift CodeQL itself remains scheduled/manual until we find a reliable configuration suitable for PR gating.

Progress note from draft PR #48 at `51d9c734`: Compose import is now grounded in Core's canonical parser and runtime projection model, with RecipeRecord available for non-live drafts/imported services. Docker-specific projection exists as dormant adapter groundwork, not an enabled app runtime.\n\nStill open: durable Compose stack storage, drift detection, edit/re-apply, re-sync, and export workflows are not implemented in this PR.

Progress update from draft PR #48 at `51d9c734`: widget/card state now sits inside the runtime-first app model and card rendering keeps using shared chart/card primitives, including the runtime-scoped morph fix.\n\nStill open: this PR does not add the next chart types or new reliable volume/path throughput metrics, so final widget options and manual readability checks remain here.

Progress update from draft PR #48 at `51d9c734`: shared visual work now routes through `Packages/ContainedUI`, colocated previews live on element declaration files, repeated implementation anatomy has package-internal `Shared` helpers, grouped forms/settings/volume surfaces were cleaned up, and AppKit usage is guarded by convention tests.\n\nStill open: manual UI polish and any follow-up visual decisions found during that pass.

Progress update from draft PR #48 at `51d9c734`: the branch now includes the grouped form cleanup, runtime-scoped Run/Edit and volume/mount wiring, Settings runtime sections driven by Core capabilities, shared `ContainedUI`/`ContainedUX` primitives, AppKit containment, and the container-card morph fix.\n\nStill open: this issue remains the manual product/UI review tracker. The branch has not completed a full visual smoke test across every listed screen.

@Ace2932 thanks you for the tips/website, i'm going to be folding these fixes into the next build 🤝

Progress note from draft PR #48 (`56700b8d`): no implementation here, by design. The PR keeps V1 Docker image behavior runtime-owned while sharing registry/search/update metadata at the app model layer.

This remains the backlog item for an optional Contained-owned OCI cache/library and explicit future "Load into Docker" / "Load into Apple container" workflows.

Progress note from draft PR #48 (`56700b8d`): repository validation and workflow path filters were tightened, and `./scripts/ci-validate.sh` now covers release-note shape, docs/wiki mapping, package-boundary invariants, script strict mode, and workflow path filters.

This issue should stay open because the core question remains Swift CodeQL reliability/per-PR suitability. Current PR CI shows Actions analysis passing and Swift analysis skipped by policy.

Progress note from draft PR #48 (`56700b8d`): this PR lays groundwork but does not close this issue. Compose import now flows through Core schema/runtime projection, Docker host-network behavior is runtime-specific, and app persistence now has `RecipeRecord` for non-live drafts/imported services.

Still open: durable stored Compose stack management, drift detection, edit/re-apply, re-sync, and export workflows.

Progress update from draft PR #48 (`56700b8d`): this is now actively in progress. The branch moves widget configuration/personalization into the runtime-first app model, routes card rendering through shared card/chart primitives, adds sparkline scaling tests, and keeps compact/expanded card behavior tied to the same persisted presentation state.

Remaining before closing: the manual UI pass still needs to confirm final chart/display choices, useful additional metrics, and visual readability in the running app.

Progress update from draft PR #48 (`56700b8d`): this is now actively in progress. The branch extracts reusable UI into `Packages/ContainedUI`, routes app views through `UI.*` primitives, adds package-internal `Shared` helpers for repeated anatomy, colocates previews with element declarations, removes dead AppKit convenience paths, and adds AppKit boundary tests.

Remaining before closing: manual UI polish/smoke review and any follow-up cleanup found during that pass.

Progress update from draft PR #48 (`56700b8d`): the branch now moves repeated visual behavior into `ContainedUI`/`ContainedUX`, keeps classic sidebar fallback intact, contains AppKit usage, fixes the runtime-scoped card morph regression, and updates docs/wiki/release notes around the new structure.

This should stay open through the manual UI polish pass because the PR has not had a full visual smoke test/review across every listed screen yet.

The stayed-in-Build-and-had-to-be-cancelled failure mode is the one place where config can cap the damage while you tune the analysis itself. You've already got `timeout-minutes` on both CodeQL jobs (15 and 45), but the four workflows that run the same SwiftPM build on macos-26 (PR, Nightly, Beta, Stable) don't set one, so the identical wedge outside CodeQL runs until GitHub's 6-hour default kills it. On macOS that hurts twice: the runner minutes are the expensive kind, and free-plan macOS concurrency is capped at 5 jobs, so one wedged build can also hold up the other channels' runs. It's one line per job, sized a bit above a normal build:

```yaml
jobs:
pr:
runs-on: macos-26
timeout-minutes: 30
```

For what it's worth, the concurrency groups across these workflows, and the path-ignores keeping appcast and docs commits off the macOS runners, are already tighter than almost anything I've scanned, this looked like the one real gap. Bit of a plug, but I built a free scanner for...

## Suggested diagnostics bundle shape

I would make the first version boring and inspectable:

- `summary.md`: human-readable overview with app version/build, update channel, macOS version, architecture, CLI path source, `container --version`, service state, and collection timestamp.
- `settings.json`: selected non-secret settings only, with experimental gates and update/logging configuration.
- `activity.json`: recent Activity entries, bounded by count/time and redacted.
- `errors.log` or `recent-errors.json`: recent user-facing errors and failed command summaries.
- `system.json`: safe system status fields and resource counts.
- `redaction-report.md`: what categories were excluded or redacted.

I would avoid including raw command output by default unless it is known-safe or user-previewed. The export UI should say what is included before writing the bundle.

Suggested implementation notes:

- Put collection/redaction in a small service layer, not inside Settings/System views.
- Reuse...