docs: Update README to reflect actual implemented features

.github/copilot-instructions.md

@@ -0,0 +1,131 @@
+# Talos - Copilot / AI Assistant Project Instructions
+
+These instructions are read automatically by GitHub Copilot Chat and should
+be treated as persistent project rules for any AI assistant working in this
+repository.
+
+---
+
+## Branch Model
+
+### Source of truth
+
+- **`v0.9.0-beta-dev`** is the active development branch.
+- **`main`** is the stable release branch. Do not target it directly.
+- All feature work branches off `v0.9.0-beta-dev` and merges back into it.
+
+### Branch rules
+
+- Always create a new feature branch from `v0.9.0-beta-dev`.
+- Never commit directly to `v0.9.0-beta-dev` or `main`.
+- Never push to `main` unless performing a deliberate release merge.
+
+### Infrastructure / tooling isolation
+
+**CI workflows, quality tooling, and build-infrastructure changes must NOT
+be merged into `v0.9.0-beta-dev` or `main` without explicit approval.**
+
+These include:
+- `.github/workflows/` files
+- JaCoCo / Sonar / Qodana / Snyk / CodeQL configuration
+- Build plugin additions that affect CI behavior
+- Quality gate threshold changes
+
+Such changes must live on their own branch (e.g., `feature/code-quality-stack`)
+and be reviewed as a standalone PR before merging into `v0.9.0-beta-dev`.
+
+**Reason:** Infrastructure changes affect every downstream branch and CI run.
+They must be intentional, not accidental side effects of a feature branch.
+
+### Current long-lived branches
+
+| Branch | Purpose | Merge target |
+|---|---|---|
+| `v0.9.0-beta-dev` | Active development | `main` (on release) |
+| `feature/retrieval-pipeline` | Retrieval + context assembly modernization | `v0.9.0-beta-dev` |
+| `feature/code-quality-stack` | CI/quality tooling (JaCoCo, Sonar, Qodana, CodeQL, Snyk) | `v0.9.0-beta-dev` (after review) |
+
+---
+
+## Project Identity
+
+Talos is a **local-first CLI workspace assistant** and execution harness for
+bounded local workspace work.
+
+Repository identity:
+
+- Product name: Talos
+- Repository name: `talos-cli`
+- GitHub repository: `ai21z/talos-cli`
+- Public description: "Local-first CLI workspace assistant with retrieval,
+  approval-gated file operations, traces, context handling, and
+  verification-oriented outcomes."
+
+Talos currently focuses on:
+
+- workspace inspection through local tools
+- local context retrieval and context packing
+- approval-gated file operations
+- bounded command execution through approved profiles
+- local traces, prompt/debug evidence, and outcome records
+- context handling across turns
+- verification-oriented completion reporting
+
+Talos is **not**:
+
+- a foundation model
+- a cloud-agent clone
+- a swarm or multi-agent platform
+- a background autonomous daemon
+- a general browser/email/calendar automation product
+- just a RAG CLI
+
+Do not weaken explicit user control, approval gates, workspace boundaries,
+traceability, or verification-oriented outcomes.
+
+---
+
+## Coding Conventions
+
+- Java 21, Gradle 8.14, Kotlin DSL (`build.gradle.kts`)
+- JUnit 5 for tests
+- Framework-neutral core; frameworks are adapters, not the architecture
+- Local-first, privacy-first
+- Keep diffs tight; avoid speculative abstractions
+- Preserve existing behavior before deleting legacy code
+
+---
+
+## Architecture Notes
+
+### Key packages
+
+- `dev.talos.core.retrieval` — retrieval pipeline, stages, traces
+- `dev.talos.core.rerank` — reranker interface and implementations
+- `dev.talos.core.context` — context packing, token budgets
+- `dev.talos.core.ingest` — parsing, chunking
+- `dev.talos.core.index` — Lucene indexing
+- `dev.talos.core.embed` — embeddings client
+- `dev.talos.core.cache` — SQLite caching
+- `dev.talos.core.llm` — LLM client abstraction
+- `dev.talos.tools` — tool registry and local workspace tool implementations
+- `dev.talos.api` — programmatic API seam (`TalosKnowledgeEngine`)
+- `dev.talos.cli` — CLI commands and REPL
+
+### Retrieval pipeline
+
+`RagService.prepare()` routes through `RetrievalPipeline`:
+BM25 → KNN → RRF Fusion → Rerank → Dedup
+
+Stages are stateless (`StageOutput` record). Traces are captured per-stage.
+
+---
+
+## What NOT to do
+
+- Do not rewrite the core around LangChain4j or Spring AI
+- Do not merge broad long-term memory into Talos core without a scoped design
+- Do not add MCP server logic until the local tool and retrieval seams are stable
+- Do not perform broad package reshuffles without a concrete reason
+- Do not delete legacy code before proving parity with new code
+- Do not push CI/quality tooling changes into dev or main without review

.github/workflows/beta-dev-ci.yml

@@ -0,0 +1,87 @@
+name: Beta Dev CI
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [v0.9.0-beta-dev]
+  push:
+    branches:
+      - v0.9.0-beta-dev
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+concurrency:
+  group: beta-dev-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gradle-check:
+    name: Gradle check (Java 21)
+    runs-on: windows-2025-vs2026
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Run unit tests
+        run: .\gradlew.bat test --no-daemon
+
+      - name: Run E2E tests
+        run: .\gradlew.bat e2eTest --no-daemon
+
+      - name: Run coverage and artifact gates
+        run: .\gradlew.bat jacocoTestReport checkGeneratedArtifactCanaries jacocoTestCoverageVerification --no-daemon
+
+      - name: Run final Gradle check
+        run: .\gradlew.bat check --no-daemon
+
+      - name: Report test result failures
+        if: failure()
+        shell: pwsh
+        run: |
+          function Escape-Annotation([string] $Value) {
+            return $Value.Replace('%', '%25').Replace("`r", '%0D').Replace("`n", '%0A')
+          }
+
+          $found = $false
+          $files = Get-ChildItem -Path build/test-results -Filter *.xml -Recurse -ErrorAction SilentlyContinue
+          foreach ($file in $files) {
+            try {
+              [xml] $xml = Get-Content -LiteralPath $file.FullName -Raw
+            } catch {
+              $path = Escape-Annotation $file.FullName
+              $message = Escape-Annotation $_.Exception.Message
+              Write-Output "::warning file=$path::Could not parse test result XML: $message"
+              continue
+            }
+
+            foreach ($case in $xml.testsuite.testcase) {
+              $nodes = @()
+              if ($case.failure) { $nodes += $case.failure }
+              if ($case.error) { $nodes += $case.error }
+              foreach ($node in $nodes) {
+                $found = $true
+                $message = if ($node.message) { $node.message } elseif ($node.InnerText) { $node.InnerText.Trim() } else { 'Test failed' }
+                $title = "$($case.classname).$($case.name)"
+                $path = Escape-Annotation $file.FullName
+                $safeTitle = Escape-Annotation $title
+                $safeMessage = Escape-Annotation $message
+                Write-Output "::error file=$path,title=$safeTitle::$safeMessage"
+              }
+            }
+          }
+
+          if (-not $found) {
+            Write-Output "No JUnit XML failures found under build/test-results."
+          }

.gitignore

@@ -35,6 +35,7 @@
 *.hprof
 hs_err_pid*
 replay_pid*
+/reports/
 
 # Qodana (JetBrains code quality) — keep config, ignore outputs
 .qodana/
@@ -67,6 +68,11 @@ test_performance.java
 validation_commands.txt
 test-remote-config.yaml
 
+# ---- Scratch/throwaway test files in root
+/test_*.java
+/test_*.class
+*.class
+
 # ---- Temporary & editor files
 *.tmp
 *.swp
@@ -75,14 +81,27 @@ test-remote-config.yaml
 *.orig
 *.rej
 
-# ---- Local test data (uncomment if you create these)
-# /local/
+# ---- Local test data
+/local/
 # /corpus/
 # /sandbox/
-# .loqj/            # if you ever generate a per-repo runtime dir (by default it lives under your HOME)
+# .talos/            # if you ever generate a per-repo runtime dir (by default it lives under your HOME)
+
+# ---- Project docs
+# Architecture and cleanup docs under docs/new-architecture are tracked.
+V1_IMPLEMENTATION_BRIDGE.md
+
+# ---- Local-only directories and files
+/playground/
+/.github/
+.claude/
 
 # ---- Security: common secret patterns (use explicit names; avoid *.yaml wildcards)
 *.env
 *.env.*
 *.secret.*
 *.private.*
+
+# Tracked fake e2e fixtures; these are not real secrets.
+!src/e2eTest/resources/fixtures/listing-privacy/.env
+!src/e2eTest/resources/fixtures/protected-path/.env