feat: bootstrap StoryCore Harbour for Anna

[zedarvates]

What

Creates StoryCore Harbour, an isolated Anna-native entry point to StoryCore Engine.

The App converts a concept or short script into a validated production package:

• production bible and visual direction;
• characters and locations with continuity rules;
• ordered scenes and shots;
• reusable generation prompts;
• continuity report;
• per-user App storage, safe delete-all, and StoryCore-compatible JSON export.

Product boundary

The core workflow is independently useful inside Anna and intentionally excludes heavy rendering.

• no Executa;
• no custom backend or provider key;
• no developer-paid inference service;
• no GPU, ComfyUI, Blender, image, audio, or video dependency in the meaningful completion path;
• StoryCore Desktop remains the advanced local production destination.

Anna confirmed on 2026-08-13 that a Host-API-only Schema 2 App can qualify without requiring users to install a local Executa/runtime.

Architecture

• Anna schema: 2 static SPA;
• direct anna.llm.complete;
• App-scope anna.storage.get/set/list/delete;
• anna.window.set_title;
• exactly one bounded repair attempt;
• canonical executable storycore-harbour.project.v1 contract;
• validation before render/save/load/export and after storage read-back;
• optimistic ETag writes and ETag-protected deletion;
• no external origin or tracker.

Reliability, security, and privacy

Implemented:

• 42 Node tests covering the contract, evaluator, privacy-safe output, safe CLI paths, and official Anna Host API harness;
• twenty invalid-contract conditions plus the valid reference project;
• exact @anna-ai/cli 0.1.30 and strict anna-app validate --strict;
• immutable twenty-prompt corpus covering all six formats, exactly ten English and ten French cases;
• deterministic real-model gate: at least 18/20 valid projects and median successful completion at or below 180 seconds;
• hidden authenticated collector activated only with ?acceptance=1;
• explicit quota/storage consent, safe stop, repair tracking, and local JSONL download;
• evaluator logs redact model-derived validation text and unknown identifiers;
• CLI file arguments are confined to existing files inside the Harbour App directory;
• generated content is rendered as text, never untrusted HTML;
• no unsafe Markdown-fence regex or silent mock fallback.

Persistence and deletion

• validated projects are saved to a versioned snapshot and projects/current;
• existing values use opaque ETags for optimistic concurrency;
• every save is read back and revalidated;
• delete-all requires two distinct clicks within 15 seconds;
• only projects/ records are listed/deleted;
• pagination is bounded and repeated cursors fail closed;
• ETags are passed to deletion when available;
• projects/current is deleted last;
• storage is re-listed/re-read before success is reported;
• unrelated App data is preserved.

Automated gates currently green

Current head 4626ab614072b9adab0c691cd61a0f02ca9e27ed passed:

• StoryCore Harbour CI run #95;
• all 42 Node tests;
• sample export, mock response, corpus, and bundle synchronization;
• strict Anna manifest validation;
• full Chromium generation/export flow at 520 × 680;
• full Chromium paginated/ETag deletion flow;
• four deterministic fictional Marketplace screenshot drafts;
• SonarQube Cloud Quality Gate with 0 new issues, 0 accepted issues, 0 security hotspots, and 0 annotations.

Anna confirmations and owner action

Anna confirmed on 2026-08-13:

• developer activation is self-service and instant after account creation, email verification, Developer ToS acceptance, and Developer Console activation;
• developer handles and App slugs are first-come-first-served and lock when claimed/created;
• launch/growth initiatives are planned for strong Apps, but no specific promotional placement is guaranteed;
• the first review submission may be made once the core workflow works end-to-end.

The owner should therefore claim storycore-labs and create the storycore-harbour App draft immediately if available. This owner-only gate is tracked in #34 and documented command by command in:

apps/storycore-harbour/review/OWNER_ACTIVATION_AND_FIRST_REVIEW.md

Repository automation must not accept legal terms or operate the owner's Anna account without an authenticated owner-controlled session.

Remaining before ready-for-review or merge

• complete issue [Harbour][Owner] Claim Anna identity and open authenticated test environment #34: activate the owner account, claim the handle, and create the working draft;
• authenticate the real Anna developer environment;
• run the fixed twenty-prompt corpus against at least one enabled model;
• pass the committed 18/20 and median-latency evaluator;
• verify production APS write/read/reload, overwrite conflict, paginated deletion, and deletion conflict behavior;
• complete NVDA, VoiceOver, zoom, and forced/high-contrast checks;
• run 10–20 external beta completions and resolve P0/P1 defects;
• obtain/review the exact Developer Terms, detailed 70% eligible-usage-profit calculation, and MAU/Qualified Run visibility;
• confirm final Marketplace asset requirements and publisher support details.

Safety boundary

This PR remains a draft. It does not modify the existing StoryCore runtime core. Do not weaken the contract, replace difficult acceptance prompts after seeing failures, add a backend/Executa, mark ready, or merge before the remaining authenticated, human, legal, and beta gates are satisfied.

[zedarvates]

Harbour gate update — 2026-08-13

The previously failing security/reliability gate is now clean on commit afcebcb575bd223840a8c695ca8ed1808a9cbb6d.

Verified green

• StoryCore Harbour CI run #90 passed every step;
• JavaScript syntax and the complete Node test suite passed;
• sample project, mock completion, fixed 20-prompt corpus, and generated bundle synchronization passed;
• anna-app validate --strict passed;
• both Chromium flows passed at the declared minimum size: normal generation/export and ETag-protected project deletion;
• Marketplace screenshot drafts were generated and uploaded;
• SonarQube Cloud Quality Gate passed with 0 new issues, 0 accepted issues, 0 security hotspots, and 0 annotations.

Hardening included

• CLI file arguments are confined to existing files inside apps/storycore-harbour/;
• acceptance reports redact model-derived validation text and unknown identifiers;
• Anna runtime import is centralized through the required same-origin platform SDK path;
• project validation, rendering, collector flow, and deletion handling were decomposed without weakening the contract;
• the risky optional Markdown-fence regex was replaced by bounded manual parsing;
• accessible names now match visible deletion labels.

Remaining external gates

The PR intentionally remains a draft. The next legitimate work is external/platform verification:

1. authenticate or activate a real Anna developer test environment;
2. run the immutable 20-prompt corpus against at least one enabled model;
3. pass the committed evaluator at ≥18/20 and median ≤180 seconds;
4. verify production APS write/read/reload, induced ETag conflict, paginated deletion, and deletion conflict behavior;
5. complete manual NVDA/VoiceOver/zoom/forced-colors checks and 10–20 external beta runs;
6. review Anna's current Developer Terms, revenue policy, MAU visibility, activation, slug/handle availability, and Marketplace review path.

Do not merge or mark ready for review before those external and contractual gates are satisfied.

[zedarvates]

External gate tracking

The owner-only Anna activation and identity-claiming work is now tracked separately in #34.

A command-by-command owner runbook was added at:

apps/storycore-harbour/review/OWNER_ACTIVATION_AND_FIRST_REVIEW.md

It separates:

1. Developer ToS review and profile activation;
2. storycore-labs handle claiming;
3. storycore-harbour working-draft creation via dry-run + apps push;
4. authenticated normal-flow and 20-prompt testing;
5. production APS/ETag verification;
6. immutable 0.1.0 cutting;
7. App Review submission;
8. public release only after approval and owner authorization.

The PR remains draft. No account, legal, review, or public-release action was executed by automation.

[zedarvates]

Business/legal gate tracking

The remaining written Anna confirmations are now tracked in #35:

• exact current Developer Terms;
• detailed 70% eligible-usage-profit calculation and payout mechanics;
• Qualified App MAU / Qualified Run definitions and dashboard visibility.

This does not block the working draft or authenticated technical tests, but it remains a public-release and business-forecast gate. No confidential agreement or account data should be posted publicly.

[zedarvates]

Final CI / Sonar root-cause validation — 2026-08-13

Validated on head c893c6f236637c63efbc99e040f0a7ff8e1d801c.

Root causes fixed

1. GitHub Actions failure: the Anna CLI 0.1.30 typed Node storage facade exposes get/set, while the test called nonexistent typed list/delete helpers. The declared schema-2 methods remain valid; the harness test now uses the generic Host API dispatcher and the real browser deletion path verifies pagination plus ETag-protected deletion.
2. Sonar Security D: local CLI tools accepted unrestricted paths and acceptance reports could emit model-derived validation text. Inputs are now confined to existing files below the Harbour App directory and public reports expose only bounded identifiers, categories, and counts.
3. Sonar Reliability D: same-origin Anna SDK imports looked like filesystem-absolute module imports to the analyzer, and several high-complexity functions mixed validation/rendering/collector responsibilities. Runtime import is centralized and the affected logic is decomposed without weakening the contract.
4. Browser races: focus movement and Host API readiness were split across independently loaded modules/tests. Form-error focus is now atomic and browser tests explicitly wait for Anna connection.
5. Non-deterministic install / incomplete deletion coverage: Harbour now commits its own lockfile, CI uses npm ci, and both normal generation/export and project deletion run in Chromium.

Verified green

• clean npm ci;
• 42/42 Node tests;
• sample contract, mock fixture, immutable corpus and generated corpus synchronization;
• anna-app validate --strict;
• npm audit: 0 vulnerabilities in the isolated Harbour package;
• Chromium at 520 x 680: validation focus, keyboard/panel focus, generation, save/read-back, export, four screenshots;
• deletion: 2 project records removed, both with ETags, unrelated App data preserved, reload returns not-found;
• GitHub Actions run 31673641683: success;
• SonarQube Cloud: Quality Gate passed, 0 new issues, 0 hotspots, 0 annotations.

Anna boundary

required_executas and optional_executas are empty. The meaningful user path calls only Anna Host APIs (llm, storage, window). It has no custom backend, external inference provider, provider key, media renderer, or Executa dependency. image is optional and deliberately not required by the core path.

Still blocked externally

This PR must remain draft and unmerged. Real Anna model acceptance (at least 18/20, median at most 180 seconds), production APS/ETag behavior, manual accessibility, beta, owner account/ToS/slug actions, and review submission are not proven by this CI. Sonar also reports 0.0% new-code coverage even though the configured Quality Gate passes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.5% Duplication on New Code

See analysis details on SonarQube Cloud