Initial Coworker app scaffold

.codex/project.md

@@ -0,0 +1,75 @@
+# Codex Project Notes
+
+## Project
+
+`Coworker` is a local-first Windows AI coding coworker. It combines a Codex-style desktop app, local model provider configuration, a persistent Brain for memory and skills, and optional iPhone/iPad PWA access.
+
+Repository:
+
+```text
+Code-Inc/Coworker
+```
+
+## Stack
+
+```text
+Electron, React, TypeScript, Vite
+```
+
+Package manager:
+
+```text
+npm
+```
+
+## Commands
+
+Run only on Gitea Ubuntu runners:
+
+```text
+INSTALL_COMMAND = npm install
+LINT_COMMAND = npm run lint
+TEST_COMMAND = npm run test
+BUILD_COMMAND = npm run build
+AUDIT_COMMAND = npm run audit
+PACKAGE_COMMAND = npm run package:win
+```
+
+Local checks are limited to lightweight validation such as `git diff --check`.
+
+## Build Artifacts
+
+Release artifacts are produced in:
+
+```text
+release/
+```
+
+Expected files:
+
+```text
+Coworker-Setup-<version>.exe
+SHA256SUMS.txt
+```
+
+## Security Rules
+
+- Web access is disabled by default.
+- LAN/PWA access requires pairing-code authentication and scoped device tokens.
+- Workspace tools may access only explicitly selected project directories.
+- Agent writes and command execution require visible user approval.
+- Local provider endpoints and tokens are stored in user app data, not tracked files.
+- Unsigned installers are acceptable until a code-signing certificate is available.
+
+## Release Rules
+
+Before a release:
+
+1. verify Gitea CI is green,
+2. run release dry-run workflow,
+3. confirm `Coworker-Setup-<version>.exe` and `SHA256SUMS.txt` exist,
+4. update `CHANGELOG.md` and release notes,
+5. create a `v*` tag,
+6. let Gitea Actions publish the release artifact.
+
+Do not create a release unless explicitly requested.