chore: untrack node_modules, repair the lockfile, and add the first CI

.github/workflows/ci.yml

@@ -0,0 +1,140 @@
+# CI for hyperdag-protocol.
+#
+# This repository had no CI at all, and 98% of its tracked files were vendored
+# node_modules. The first thing an external reviewer does is clone and install,
+# and until now that failed — so the most valuable check here is the boring one:
+# `npm ci` from the committed lockfile has to work.
+#
+# DESIGN RULE: no vacuous green. Four of five packages have no tests. A single
+# green tick across the repo would claim coverage that does not exist, so the
+# `coverage-map` job prints the real per-package state and the contract tests
+# report their true tally rather than being hidden.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # The gate that actually regressed. Blocking on purpose: if a clean clone
+  # cannot install from the lockfile, nothing else in this file means anything.
+  install:
+    name: clean install from lockfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - name: npm ci (root workspace)
+        run: npm ci
+      - name: assert node_modules is not tracked
+        # The regression this repo actually had. Cheap to check, and it fails
+        # the moment someone commits a dependency tree again.
+        run: |
+          count=$(git ls-files | grep -c '^node_modules/' || true)
+          echo "tracked node_modules files: $count"
+          if [ "$count" -ne 0 ]; then
+            echo "::error::node_modules is tracked again ($count files). It is build output; the lockfile is the record."
+            exit 1
+          fi
+
+  # Marco's ERC-8004 contract tests. NON-BLOCKING and reported honestly:
+  # 26 of 61 currently fail on a drift between the tests and the contract ABI
+  # ("Event NewFeedback with argument count 11 not found in the contract ABI").
+  # That failure PRE-DATES this workflow — verified by running the suite against
+  # the original committed dependency tree, which produces the identical 35/26.
+  # It is surfaced, not fixed: packages/contracts is owned elsewhere.
+  contracts:
+    name: contracts tests (known 26/61 failing — reported, not gating)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - name: run contract tests
+        # hardhat.config.ts requires these to be present or the config itself is
+        # rejected (HHE15) before a single test runs. Public read-only endpoints:
+        # the suite under test is local, so this makes an ENV failure impossible
+        # to mistake for a TEST failure.
+        env:
+          SEPOLIA_RPC_URL: https://ethereum-sepolia-rpc.publicnode.com
+          MAINNET_RPC_URL: https://ethereum-rpc.publicnode.com
+        working-directory: packages/contracts
+        run: npm test 2>&1 | tee ../../contracts-test.log || true
+      - name: report the real tally
+        run: |
+          pass=$(grep -oP '^# pass \K\d+' contracts-test.log | head -1 || echo "?")
+          fail=$(grep -oP '^# fail \K\d+' contracts-test.log | head -1 || echo "?")
+          echo "### Contract tests: $pass passing, $fail failing" >> "$GITHUB_STEP_SUMMARY"
+          echo "Baseline at the time this workflow was added: 35 passing, 26 failing." >> "$GITHUB_STEP_SUMMARY"
+          if [ "$fail" != "?" ] && [ "$fail" -gt 26 ]; then
+            echo "::warning::contract failures increased beyond the 26 baseline (now $fail)"
+          fi
+
+  # Makes absence of tests VISIBLE. An unwired safeguard is worse than an absent
+  # one because it converts a known gap into false coverage; the same is true of
+  # a package that silently has no tests at all.
+  coverage-map:
+    name: per-package test coverage map
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: enumerate
+        run: |
+          {
+            echo "### Which packages actually have tests"
+            echo ""
+            echo "| package | test script | script matches files | test files |"
+            echo "|---|---|---|---|"
+            # Enumerate by MANIFEST, not by directory depth.
+            #
+            # The first version of this loop globbed `packages/*/` — one level —
+            # and so reported on circuits/contracts/defaults/interfaces/protocol
+            # while the only real packages live one level deeper at
+            # packages/defaults/*/. It also credited `packages/defaults` with a
+            # test-file count gathered by a `find` that DID recurse, so a
+            # directory with no manifest appeared to have tests. A job whose
+            # stated purpose is making absent tests visible was itself reporting
+            # a status it had no means to determine. Finding a package is now
+            # done the only way that cannot drift: locate its package.json.
+            git ls-files '*package.json' \
+              | grep -v node_modules \
+              | grep -v '^package.json$' \
+              | sort \
+              | while read -r manifest; do
+                  dir=$(dirname "$manifest")
+                  name=${dir#packages/}
+                  script=$(node -e "try{const s=require('./$manifest').scripts||{};process.stdout.write(s.test||'')}catch(e){}" 2>/dev/null)
+                  if [ -n "$script" ]; then
+                    has="\`$script\`"
+                    # A declared script proves nothing if its glob matches no file.
+                    # hallucination-hal-local declares `node --test tests/*.test.ts`
+                    # and ships only .mjs smoke files, so it greens over an empty set.
+                    pattern=$(echo "$script" | grep -oE '[A-Za-z0-9_./*-]+\.(test|spec)\.[a-z]+' | head -1)
+                    if [ -n "$pattern" ]; then
+                      # shellcheck disable=SC2086
+                      matched=$(ls $dir/$pattern 2>/dev/null | wc -l)
+                      [ "$matched" -gt 0 ] && matches="$matched" || matches="**0 — greens over an empty set**"
+                    else
+                      matches="n/a"
+                    fi
+                  else
+                    has="**none**"
+                    matches="—"
+                  fi
+                  files=$(find "$dir" -path '*/node_modules' -prune -o \
+                            \( -name '*.test.*' -o -name '*.spec.*' -o -path '*/tests/*' -o -path '*/test/*' \) -type f -print 2>/dev/null | wc -l)
+                  echo "| $name | $has | $matches | $files |"
+                done
+          } >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -0,0 +1,44 @@
+# Dependencies — restored by `npm ci` from the committed lockfiles, never committed.
+# This file did not exist, which is why 4,526 vendored files (98% of the tracked
+# tree) were in git. The lockfiles are the reproducible record; node_modules is
+# build output.
+node_modules/
+
+# Build output
+dist/
+build/
+out/
+*.tsbuildinfo
+
+# Solidity / Hardhat toolchain artifacts (packages/contracts)
+artifacts/
+cache/
+typechain/
+typechain-types/
+
+# Nx
+.nx/cache
+.nx/workspace-data
+
+# Environment + secrets. Never commit a real one; .env.example is the template.
+.env
+.env.*
+!.env.example
+
+# Coverage + test output
+coverage/
+*.lcov
+.nyc_output/
+
+# Editor / OS noise
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/*
+!.vscode/extensions.json
+*.swp
+
+# Logs
+*.log
+npm-debug.log*
+yarn-error.log*