Build the auto-commit engine

Every settled change on a git-mode board commits, debounced 2s past
drag/typing churn, staged whole-root with .gitignore respected.
GitCommitOperation reaches the vendored libgit2 directly (same 1.9.2
pin SwiftGitX resolves — importable, not duplicated) for
signature-capable commits; add-git's config materialization is gone,
identity resolves at commit time (repo-local config, else derived
default) per the 2026-07-31 ruling in 06. CommitAttribution
classifies per file off EchoLedger receipts: user identity on
app-mediated windows, Lanework External <[email protected]>
on foreign, the modified-by refinement (<slug>@agents.lanework
.invalid) when every foreign file agrees, heal-marked receipts split
into their own commit — window split foreign → heal → user.
Edit-session granularity: ~700ms saves stay uncommitted, staging
excludes open session folders (closure-resolved so mid-session moves
stage around the new location), session end nudges the debounce so
each session lands exactly one body commit. Flush-before-overwrite
gates on known-foreign windows and commits synchronously ahead of
the write; close/quit flush the pipeline via CloseFlushCoordinator's
committerFlush. index.lock backs off briefly then re-debounces
silently; clean tree no-ops; genuine failures ride the standing
history-suspension banner and retry next debounce. Abnormal repo
states (detached HEAD, merge/rebase/cherry-pick in progress) hold
the engine with a 15s re-check; unborn HEAD commits "Initial board
state" whole-tree; dirty tree at open catches up through the same
engine. Message seam (CommitMessageComposing) ships interim — the
semantic composer is the next card.

Discovery diffs HEAD against an in-memory index with rename
detection (git status alone never pairs a bare mv), and a failed
survey reads as "could not look", never "nothing changed".

46 new tests / 8 suites, all real repositories via bundled libgit2.
2240 tests / 383 suites green; InertGitTests untouched.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/Git/HistoryStore.swift

@@ -64,11 +64,59 @@ public final class HistoryStore {
     /// add-git's failure surface either way.
     public private(set) var lastFailure: GitOperationFailure?
 
+    /// **The auto-commit engine** (06-history-undo.md ▸ Rules ▸ Auto-commit), or `nil` on a board
+    /// there is no repository to commit into.
+    ///
+    /// Its existence is exactly `mode == .git`, and that invariant is the tier gate one level down:
+    /// no `HistoryStore` off Pro means no committer anywhere off Pro, with nothing to disable and no
+    /// flag to forget.
+    ///
+    /// **Composed inert and started separately.** Composition happens on the board-open path, where
+    /// nothing may block and where a session does not exist yet; `activateAutoCommit(_:)` is what
+    /// `AppModel.beginSession` calls once the store, the banner strip and the card windows are
+    /// reachable, and it is what arms the launch catch-up. A `HistoryStore` built without a session —
+    /// a test, a storeless consumer — therefore has a committer that never runs.
+    public private(set) var committer: GitAutoCommitter?
+
+    /// The board's write-provenance ledger, held so an add-git flip can build a committer over the
+    /// same one the session's store owns.
+    @ObservationIgnored
+    private let ledger: EchoLedger
+
+    /// How the session wires a committer up, remembered so the one built by a mid-session add-git
+    /// gets the same treatment as the one composed at open.
+    @ObservationIgnored
+    private var autoCommitWiring: ((GitAutoCommitter) -> Void)?
+
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "git")
 
-    init(boardRoot: URL, mode: BoardGitMode) {
+    init(boardRoot: URL, mode: BoardGitMode, ledger: EchoLedger) {
         self.boardRoot = boardRoot
         self.mode = mode
+        self.ledger = ledger
+        if mode == .git {
+            committer = GitAutoCommitter(boardRoot: boardRoot, ledger: ledger)
+        }
+    }
+
+    /// **Wires the committer into its session and starts it** — `AppModel.beginSession`'s call.
+    ///
+    /// Separate from composition for two reasons that point the same way: the seams a committer needs
+    /// (the banner strip, the board's snapshot, the card windows' Edit sessions) belong to a session
+    /// that does not exist when `compose` runs, and arming a debounce is a side effect no *detection*
+    /// should have. The wiring is remembered because add-git can produce a committer later, and a
+    /// board that flipped into git mode mid-session must commit exactly like one that opened in it.
+    public func activateAutoCommit(_ wire: @escaping (GitAutoCommitter) -> Void) {
+        autoCommitWiring = wire
+        guard let committer else { return }
+        wire(committer)
+        committer.start()
+    }
+
+    /// Stops the committer — the session's teardown, so a closed board's debounce cannot fire against
+    /// a store that has gone.
+    public func stopAutoCommit() {
+        committer?.stop()
     }
 
     /// **The tier gate and the open-time detection, in one line** (12-editions.md ▸ The provider
@@ -83,11 +131,17 @@ public final class HistoryStore {
     /// **Adoption needs no step of its own**: a board whose root already carries `.git` lands in
     /// `.git` here, silently, with no dialog and nothing to confirm — "the repo's presence *is* the
     /// opt-in" (06 ▸ Rules ▸ Adoption).
-    public static func compose(boardRoot: URL, tier: Tier) -> HistoryStore? {
+    ///
+    /// - Parameter ledger: the board's write-provenance ledger (`BoardStore.echoes`) — what the
+    ///   auto-committer classifies each changed file against. Defaulted to a fresh one so a
+    ///   store-less `HistoryStore` still composes: an empty ledger vouches for nothing, which is the
+    ///   honest answer for a git state with no session behind it (everything reads foreign, the
+    ///   launch-catch-up doctrine).
+    public static func compose(boardRoot: URL, tier: Tier, ledger: EchoLedger = EchoLedger()) -> HistoryStore? {
         guard tier == .pro else { return nil }
         let mode = BoardGitMode.detect(boardRoot: boardRoot)
         logger.debug("board opened in git mode \(mode.rawValue, privacy: .public)")
-        return HistoryStore(boardRoot: boardRoot, mode: mode)
+        return HistoryStore(boardRoot: boardRoot, mode: mode, ledger: ledger)
     }
 
     // MARK: - Add git
@@ -125,6 +179,16 @@ public final class HistoryStore {
         case .success(let branchName):
             mode = .git
             branch = branchName
+            // **The commanded mid-session flip, carried through to the engine** (06 ▸ Rules ▸
+            // Detection: "clicking it flips the open board into git mode immediately — the popover
+            // flows straight into the git controls, the first auto-commit follows"). The root commit
+            // has already landed inside `create`, so what `start()` arms here finds a clean tree and
+            // no-ops; what it buys is that the *next* settled change commits, exactly as on a board
+            // that opened in git mode.
+            let committer = GitAutoCommitter(boardRoot: root, ledger: ledger)
+            self.committer = committer
+            autoCommitWiring?(committer)
+            committer.start()
             Self.logger.notice("add-git initialized a repository at \(root.path, privacy: .public)")
             return true
         case .failure(let failure):