[hollandcloud]

Cleared worked while someone was looking at it. This PR makes it something you can install, leave running, and trust to offer only buttons GitHub will honour.

Tracked on the board as LAB-8.

What was wrong

Confirmed against the running app or the live API before being changed:

• Nothing happened until the icon was first clicked. Polling started from the panel view, which a window-style MenuBarExtra doesn't build until it's opened. The old build logged nothing in the 35 seconds after launch; the new one logs starting within half a second, with no click.
• A fresh clone didn't build. project.yml pointed at the gitignored Local.xcconfig, so XcodeGen rejected the spec on every machine but the author's.
• Merge was offered where GitHub would refuse. Readiness ignored required reviews and branch rules, the merge wasn't pinned to a commit, and the merge-method setting failed outright on repos that don't allow it.
• Start a workflow listed workflows that can't be started, always sent no inputs, and assumed main.
• Rate limits: the footer mixed the REST and GraphQL budgets; 429s and secondary limits weren't handled; a revoked token raised a banner every poll.
• Dead settings (notifyOnFailure, confirmBeforeMerge), one-way Ignore, no UI for pinned repos, reject() with no UI, and a few smaller bugs listed in CHANGELOG.md.
• make preview no longer launched on current Xcode, and killed any running copy of the app first.

What changed

• Lifecycle — an app delegate owns the model and starts it on launch. Launch at login in Settings.
• Merging — gated on GitHub's mergeStateStatus and reviewDecision; sends the head SHA; falls back to a merge method the repo allows.
• Workflows — one GraphQL request reads .github/workflows; a small reader finds workflow_dispatch and its declared inputs. Checked against 18 real workflow files from cli/cli: all 10 with the trigger found, the 4 without rejected.
• Rate limits and auth — budgets tracked per resource; a limit pauses that budget until the time GitHub gave; a 401 returns to the connect screen with an explanation.
• Also — reject a held deployment, optional two-click confirm, Clear / Re-run on notifications, hourly rediscovery, reversible Ignore and pinning, app icon, unified logging.
• Token scope — only repo is needed. The README asked for workflow too; none of the endpoints require it.
• Tooling — make install, make dist (Developer ID + notarize + staple), CI on macOS 15 and 26.

Verification

• CI passes on macOS 15 (Xcode 16.4, Swift 6.1) and macOS 26 (Xcode 26.6, Swift 6.3). Its first two runs earned their keep: a compiler crash on Swift 6.1–6.3 and a strict-concurrency error on 6.1, neither reproducible on the Swift 6.4 this was written with. Both are fixed in their own commits.
• 78 tests in 16 suites, up from 17 in 8, against a stubbed GitHub and an in-memory token vault. The app that hosts them stays inert: a test run logs exactly two starting lines, matching the two tests that call start(), and none from the host launching.
• Fresh clone: this branch with no Local.xcconfig passes make test and make release (ad-hoc signed, hardened runtime).
• Live, read-only: the real client code run against github.com with a token held in memory. 20 repositories discovered; a second identical polling pass cost 0 REST calls; 24 open pull requests decoded, one correctly held back as behind its base branch; 38 manually startable workflows across 8 repositories with 55 declared inputs, no errors. No write endpoint was called.
• Installed build: make install at this branch's head. The copy in /Applications reports 0.4.0, matches the build output byte for byte, has a valid hardened-runtime signature, and logs starting on launch with no click.
• UI: panel, Settings and the workflow sheet checked in the preview harness; control labels read back through the Accessibility API; ⌘, opens Settings.

Not exercised: any write action against real GitHub (clear, reject, merge, re-run, dispatch), the notification buttons on a live hold, and whether the panel closing is detected — the panel can't be dismissed by synthetic input, so that path is covered two ways in code but unconfirmed.

Worth a careful look

• The tests run hosted inside the app. Before token storage was made injectable, a sign-out test would have deleted the real Keychain token of whoever ran it. TokenVault exists for that reason; please keep new model tests on MemoryVault.
• WorkflowFile is not a YAML parser. It reads the shapes an on: block is written in and nothing else. A workflow whose inputs are written as an inline {…} mapping is listed as startable but with no inputs shown.
• Notification actions (Clear, Re-run) go through the same model methods as the buttons, and those are tested, but the notification click path itself hasn't been exercised on a live hold.
• Behaviour changes: failed runs older than 30 days are hidden, since GitHub won't re-run them; a pull request with no checks at all still gets no Merge button, as before.

Not in this PR

• No release is tagged and nothing has been notarized. make dist is ready, but publishing needs a decision and Apple credentials.
• Branch protection on main is still off.

🤖 Generated with Claude Code