fix(FocalPoint): add serde_json::json import, align clippy MSRV

.dockerignore

@@ -0,0 +1,69 @@
+.git
+.gitignore
+*.md
+.env*
+!.env.example
+# Build artifacts
+target/
+dist/
+build/
+*.o
+*.a
+*.so
+# IDE
+.vscode/
+.idea/
+*.swp
+.DS_Store
+# Test/nested
+**/node_modules
+**/target
+**/.pytest_cache
+**/__pycache__
+**/*.test
+**/tests/
+# Logs
+*.log
+**/*.log
+# Coverage reports
+coverage/
+.coverage
+*.coverage
+# Python virtual environments
+venv/
+env/
+virtualenv/
+# npm/yarn
+package-lock.json
+yarn.lock
+pnpm-lock.yaml
+# Rust
+**/.cargo
+**/Cargo.lock
+# Go
+go.sum
+vendor/
+go-build/
+# Java
+*.class
+**/.gradle
+**/build/
+**/target/
+**/.maven/
+# Node.js
+.next/
+.nuxt/
+/.output/
+.dist/
+# TypeScript
+**/tsconfig.tsbuildinfo
+# Docker compose
+docker-compose.override.yml
+# Local dev files
+local.env
+.env.local
+# Temp files
+*.tmp
+*.temp
+**/temp/
+**/tmp/

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Phenotype org
+    url: https://github.com/KooshaPari
+    about: Other Phenotype-ecosystem repos and discussions

.github/workflows/cargo-audit.yml

@@ -8,11 +8,17 @@ on:
   schedule:
     - cron: '37 5 * * 3'
   workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
-      - uses: rustsec/audit-check@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cargo-deny.yml

@@ -15,17 +15,24 @@ on:
   schedule:
     - cron: '0 9 * * 1'
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   cargo-deny:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: 1.85
 
       - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v6
+        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v2.0.17
         with:
           rust-version: stable

.github/workflows/ci.yml

@@ -1,11 +1,19 @@
 name: CI
 on: [push, pull_request]
+
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: 1.85
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - run: cargo test --all-features --workspace
-      - run: cargo clippy --all-features -- -D warnings 2>/dev/null || cargo check
+      - run: cargo clippy --all-features -- -D warnings

.github/workflows/journey-gate.yml

@@ -44,6 +44,10 @@
         default: 'false'
         type: boolean
 
+permissions:
+  contents: read
+  actions: read
+
 env:
   PHENOTYPE_JOURNEY_STRICT: ${{ inputs.strict_mode || 'true' }}
 
@@ -55,7 +59,7 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # ---------------------------------------------------------------------
       # 1. Install runtime dependencies
@@ -126,7 +130,7 @@
             exit 1
           fi
 
-          COUNT=$(echo "$MANIFESTS" | grep -c . || true)
+          COUNT=$(echo "$MANIFESTS" | grep -c .)
           echo "MANIFEST_COUNT=$COUNT" >> $GITHUB_OUTPUT
           echo "MANIFEST_LIST<<EOF" >> $GITHUB_OUTPUT
           echo "$MANIFESTS" >> $GITHUB_OUTPUT
@@ -177,7 +181,7 @@
                 exit 1
               fi
             else
-              phenotype-journey assert "$manifest" || true
+              phenotype-journey assert "$manifest"
               echo "(non-strict run — violations do not fail the build)"
             fi
           done
@@ -234,6 +238,7 @@
   stub-mode:
     name: Journey Gate — No Manifests Found
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: journey-gate
     if: needs.journey-gate.result == 'failure' && needs.journey-gate.outputs.MANIFEST_COUNT == '0'
     steps:

.github/workflows/scorecard.yml

@@ -6,29 +6,32 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
-permissions: read-all
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   scorecard:
     name: Scorecard analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       id-token: write
       contents: read
       actions: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.4.4
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3
         with:
           sarif_file: results.sarif

.github/workflows/trufflehog.yml

@@ -4,14 +4,18 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   trufflehog:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
-      - uses: trufflehog/actions/setup@main
-      - run: trufflehog github --only-verified --no-update
-        env:
-          #
+      - uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.95.2
+        with:
+          extra_args: --only-verified --no-update

.gitignore

@@ -2,3 +2,6 @@ pr_details.jsonl
 
 # Rust build artifacts
 /target
+
+# Example FPL scripts (scaffold output)
+/examples/fpl

CLAUDE.md

@@ -5,7 +5,7 @@ Connector-first screen-time management platform. Native iOS enforcement built on
 ## Stack
 | Layer | Technology |
 |-------|------------|
-| Core | Rust (cargo workspace, 54+ crates) |
+| Core | Rust (cargo workspace, 56 crates) |
 | Mobile | Swift/SwiftUI (iOS native app) |
 | Backend | Go (services/) |
 | DB | SQLite, PostgreSQL, SurrealDB |
@@ -34,7 +34,7 @@ xcrun simctl list devices
 ```
 
 ## Key Files
-- `crates/` — 54 Rust workspace crates
+- `crates/` — 56 Rust workspace crates
 - `apps/` — Application entry points (iOS, CLI, etc.)
 - `services/` — Go backend services
 - `tooling/` — Build and developer tooling