fix: per-provider error resilience and /providers remove TUI command

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = tab
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owner for everything
+* @KooshaPari

.github/FUNDING.yml

@@ -0,0 +1,11 @@
+github: []
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: "npm/[email protected]"
+community_bridge: # Replace with a single Community Bridge project slug-id
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project slug-e.g.
+custom: # Replace with up to 3 custom sponsorship URLs e.g. ['https://example.com/donate']

.github/branch-protection.main.json

@@ -0,0 +1,33 @@
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": [
+      "ci",
+      "lint",
+      "test",
+      "cargo-deny",
+      "trufflehog"
+    ]
+  },
+  "enforce_admins": true,
+  "required_pull_request_reviews": {
+    "dismiss_stale_reviews": true,
+    "require_code_owner_reviews": true,
+    "required_approving_review_count": 1,
+    "require_last_push_approval": true,
+    "bypass_pull_request_allowances": {
+      "users": ["KooshaPari"],
+      "teams": ["maintainers"],
+      "apps": ["renovate", "github-actions"]
+    }
+  },
+  "restrictions": null,
+  "required_linear_history": true,
+  "allow_force_pushes": false,
+  "allow_deletions": false,
+  "block_creations": false,
+  "required_conversation_resolution": true,
+  "lock_branch": false,
+  "allow_fork_syncing": true,
+  "required_signatures": true
+}

.github/workflows/autofix.yml

@@ -31,8 +31,12 @@ env:
     - main
 jobs:
   lint:
-    name: Lint Fix
+    # Advisory-only: auto-commits style fixes via autofix.ci.
+    # Blocking gates live in lint.yml (fmt --check) and test.yml (nextest).
+    # This job must NOT block merges — it is informational.
+    name: Lint Fix (advisory)
     runs-on: ubuntu-latest
+    continue-on-error: true
     permissions:
       contents: read
     steps:

.github/workflows/cargo-deny.yml

@@ -0,0 +1,22 @@
+name: Cargo Deny
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+      - name: Check
+        run: cargo deny check --log-level error

.github/workflows/helios-lite-nightly.yml

@@ -0,0 +1,79 @@
+# helios-lite-nightly — Gate 5b
+#
+# Coordinates the nightly reset/dev-publish path on the renamed-binary
+# surface. Runs every day at 06:30 UTC after the Omniroute nightly
+# (`argismonitor-nightly.yml`) so the rename cycles stay deterministic.
+#
+# Cron:
+#   cron: '30 6 * * *'
+
+name: helios-lite-nightly
+
+on:
+  schedule:
+    - cron: "30 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  rebuild-nightly-container:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      HELIOSLITE_REPO: ${{ github.repository }}
+      HELIOSLITE_RELEASES_BACKEND: "github"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo registry/target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: helios-nightly-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: cargo fmt + clippy
+        run: |
+          cargo fmt --all -- --check
+          cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+      - name: cargo test (workspace)
+        run: |
+          cargo test --workspace --all-features --quiet
+
+      - name: Build renamed binary
+        run: |
+          cargo build --release -p forge_main --bin helioslite
+          cargo build --release -p forge_main --bin forge-dev
+
+      - name: Smoke-test renamed binary
+        run: ./target/release/helioslite --version
+
+      - name: Upload named artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: helioslite-nightly-${{ github.run_number }}
+          path: |
+            target/release/helioslite
+            target/release/forge-dev
+
+  notify-track:
+    runs-on: ubuntu-latest
+    needs: rebuild-nightly-container
+    if: always()
+    steps:
+      - name: Emit GitHub event
+        run: |
+          echo "helios-lite-nightly: ${{ needs.rebuild-nightly-container.result }}"
+          echo "ship-to-tracker: phenomonitor://nightly?project=helioslite&date=$(date -u +%Y-%m-%d)"

.github/workflows/lint.yml

@@ -0,0 +1,53 @@
+name: lint
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+jobs:
+  fmt:
+    name: "Format check (rustfmt)"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain (stable + rustfmt)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          components: rustfmt
+
+      - name: cargo fmt --check
+        run: cargo fmt --all -- --check
+
+  clippy:
+    name: "Clippy (-D warnings)"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system deps
+        run: sudo apt-get update -q && sudo apt-get install -y libsqlite3-dev protobuf-compiler
+
+      - name: Setup Rust toolchain (stable + clippy)
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          components: clippy
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: cargo clippy -D warnings
+        env:
+          RUSTFLAGS: "-D warnings"
+        run: cargo clippy --all-targets --all-features -- -D warnings

.github/workflows/release-attestation.yml

@@ -0,0 +1,86 @@
+name: Release Attestation
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+jobs:
+  build-and-attest:
+    name: Build and Attest (SLSA Build L2)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    env:
+      CARGO_WORKDIR: .
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry and build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            . -> target
+
+      - name: Build release artifacts
+        working-directory: ${{ env.CARGO_WORKDIR }}
+        run: |
+          set -euo pipefail
+          cargo build --release --locked --workspace --all-targets
+
+      - name: Stage release artifacts
+        working-directory: ${{ env.CARGO_WORKDIR }}
+        run: |
+          set -euo pipefail
+          mkdir -p release-artifacts
+          # Copy all built executables
+          find target/release -maxdepth 1 -type f -executable \
+            -exec cp -t release-artifacts/ {} + 2>/dev/null || true
+          # Source tarball
+          tar \
+            --exclude='./target' \
+            --exclude='./.git' \
+            --exclude='./release-artifacts' \
+            -czf release-artifacts/source.tar.gz \
+            -C "$GITHUB_WORKSPACE/${{ env.CARGO_WORKDIR }}" .
+          # Build manifest
+          cat > release-artifacts/BUILD_MANIFEST.txt <<EOF
+          # Release Build Manifest
+          repository: ${{ github.repository }}
+          ref:        ${{ github.ref }}
+          sha:        ${{ github.sha }}
+          runner:     ${{ runner.os }}
+          rustc:      $(rustc --version)
+          cargo:      $(cargo --version)
+          built_at:   $(date -u +%Y-%m-%dT%H:%M:%SZ)
+          EOF
+          echo "=== Release artifacts ==="
+          ls -la release-artifacts/
+
+      - name: Upload artifacts for provenance
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-artifacts
+          path: ${{ env.CARGO_WORKDIR }}/release-artifacts/
+          if-no-files-found: warn
+          retention-days: 90
+
+      - name: Attest build provenance (SLSA Build L2)
+        uses: slsa-framework/slsa-github-generator/attest-build-provenance@v1
+        with:
+          artifact-name: release-artifacts