Build the auto-commit engine

Every settled change on a git-mode board commits, debounced 2s past
drag/typing churn, staged whole-root with .gitignore respected.
GitCommitOperation reaches the vendored libgit2 directly (same 1.9.2
pin SwiftGitX resolves — importable, not duplicated) for
signature-capable commits; add-git's config materialization is gone,
identity resolves at commit time (repo-local config, else derived
default) per the 2026-07-31 ruling in 06. CommitAttribution
classifies per file off EchoLedger receipts: user identity on
app-mediated windows, Lanework External <[email protected]>
on foreign, the modified-by refinement (<slug>@agents.lanework
.invalid) when every foreign file agrees, heal-marked receipts split
into their own commit — window split foreign → heal → user.
Edit-session granularity: ~700ms saves stay uncommitted, staging
excludes open session folders (closure-resolved so mid-session moves
stage around the new location), session end nudges the debounce so
each session lands exactly one body commit. Flush-before-overwrite
gates on known-foreign windows and commits synchronously ahead of
the write; close/quit flush the pipeline via CloseFlushCoordinator's
committerFlush. index.lock backs off briefly then re-debounces
silently; clean tree no-ops; genuine failures ride the standing
history-suspension banner and retry next debounce. Abnormal repo
states (detached HEAD, merge/rebase/cherry-pick in progress) hold
the engine with a 15s re-check; unborn HEAD commits "Initial board
state" whole-tree; dirty tree at open catches up through the same
engine. Message seam (CommitMessageComposing) ships interim — the
semantic composer is the next card.

Discovery diffs HEAD against an in-memory index with rename
detection (git status alone never pairs a bare mv), and a failed
survey reads as "could not look", never "nothing changed".

46 new tests / 8 suites, all real repositories via bundled libgit2.
2240 tests / 383 suites green; InertGitTests untouched.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

project.yml

@@ -35,6 +35,22 @@ packages:
   SwiftGitX:
     url: https://github.com/ibrahimcetin/SwiftGitX
     exactVersion: 0.4.0
+  # **The C library underneath SwiftGitX, named directly** (06-history-undo.md ▸ Interaction with
+  # external writers: "foreign changes are committed under the pinned synthetic author"). SwiftGitX
+  # 0.4.0's `commit(message:)` takes no signature — its `CommitOptions` leaves `author`/`committer`
+  # null and libgit2 falls back to `git_signature_default`, which reads a config the sandbox cannot
+  # see — so the auto-committer's per-commit authorship is unreachable through the wrapper. It
+  # reaches `git_commit_create` itself (`GitCommitOperation`), which needs the same vendored module
+  # SwiftGitX imports.
+  #
+  # **The same package SwiftGitX already resolves**, pinned to the version SwiftGitX pins exactly
+  # (`.package(url: …/libgit2.git, exact: "1.9.2")`): this adds no second copy of libgit2 to the
+  # binary and no second resolution to argue with — it makes a module the app already links
+  # *importable*. A drift between these two pins is a resolver error at build time, which is the
+  # loudest place for it to be.
+  libgit2:
+    url: https://github.com/ibrahimcetin/libgit2.git
+    exactVersion: 1.9.2
 
 settings:
   base:
@@ -100,6 +116,7 @@ targets:
         product: Markdown
       - package: IndieAbout
       - package: SwiftGitX
+      - package: libgit2
     postBuildScripts:
       - script: '"${SRCROOT}/../indie-skills/skills/app-versioning/scripts/update_build_info.sh"'
         name: Update Build Info