feat: version post content, add Wikipedia support, and ship Firefox pipeline

Introduce a versioned content model across the API/database:
- Add PostVersion, ContentBlob, ImageOccurrenceSet/ImageOccurrence, and PostVersionViewCredit.
- Move Investigation linkage from (postId, contentHash) to postVersionId.
- Extend Platform metadata with WikipediaMeta and add WIKIPEDIA platform support.

Add and align migrations for the new model:
- Add 0011 post image occurrences, 0012 wikipedia platform/meta, 0014 wikipedia title index drop, and 0015 post versions backfill.
- Backfill uses deterministic occurrence payload hashing and version hashing (sha256(contentHash + '\n' + occurrencesHash)).
- Add collision guards and restore DB invariants/lineage enforcement via constraints + triggers.
- Enforce PostVersion provenance consistency (SERVER_VERIFIED vs CLIENT_FALLBACK fields).

Refactor extension-facing API contracts:
- Introduce post.registerObservedVersion and keep post.recordViewAndGetStatus as a postVersionId-based view-credit/status call.
- Update investigateNow to accept postVersionId.
- Extend batchStatus lookup with versionHash-aware inputs.

Expand canonicalization and investigation internals:
- Add canonical-resolution service and dependency-injected request-identity/openai-key-validation-core helpers.
- Extend canonical content fetching with Wikipedia revision-based fetch/normalization.
- Move investigation orchestration to postVersion-backed content/image context.
- Add image-occurrence-aware multimodal prompt assembly with resolved/missing/omitted image states and validation context notes.

Upgrade extension architecture and platform coverage:
- Add Wikipedia URL parsing + adapter extraction (content/image occurrences/metadata).
- Split background logic into reusable modules (api-client-core, browser-compat, investigation/page-content state helpers).
- Switch background view flow to registerObservedVersion -> recordViewAndGetStatus and use postVersionId for investigateNow.
- Keep popup/options/content plumbing aligned with new protocol and schema changes.

Ship cross-browser build/release flow:
- Build Chrome + Firefox artifacts (dist + dist/firefox) with manifest transformation and Firefox background/content bundling.
- Strengthen artifact assertions for both browser targets.
- Update release workflow to run full checks, package/sign/publish Chrome and Firefox zips, and report bundle sizes.
- Update PR checks to include formatting and coverage gates.

Improve tooling, tests, and documentation:
- Add Prettier config/ignore, format scripts, and c8 coverage configs for shared/api/extension.
- Tighten ESLint strict-boolean-expressions and clean type-safe conditionals across code.
- Expand unit/integration/e2e coverage across shared/api/extension for new protocol/platform behavior.
- Update README, SPEC, and AGENTS docs for post-version flow, Wikipedia support, and Chrome+Firefox usage.

Author: hugbubby

.github/workflows/pr-checks.yml

@@ -124,7 +124,7 @@ jobs:
         run: pnpm db:generate
 
       - name: Lint and dead-code checks
-        run: pnpm lint && pnpm knip
+        run: pnpm lint && pnpm knip && pnpm format:check
 
   test:
     needs: [should-run]
@@ -174,6 +174,9 @@ jobs:
       - name: Run tests
         run: pnpm test
 
+      - name: Run coverage checks
+        run: pnpm test:coverage
+
   build:
     needs: [should-run]
     if: >-
@@ -210,6 +213,38 @@ jobs:
       - name: Build workspace
         run: pnpm build
 
+      - name: Summarize extension bundle sizes
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          chrome_dir="extension/dist"
+          firefox_dir="extension/dist/firefox"
+
+          chrome_bytes="$(du -sb "$chrome_dir" | awk '{print $1}')"
+          firefox_bytes="$(du -sb "$firefox_dir" | awk '{print $1}')"
+
+          {
+            echo "### Extension Bundle Size Report"
+            echo
+            echo "| Artifact | Bytes | MiB |"
+            echo "|---|---:|---:|"
+            echo "| Chrome dist dir | ${chrome_bytes} | $(awk "BEGIN {printf \"%.2f\", ${chrome_bytes}/1048576}") |"
+            echo "| Firefox dist dir | ${firefox_bytes} | $(awk "BEGIN {printf \"%.2f\", ${firefox_bytes}/1048576}") |"
+            echo
+            echo "#### Largest JS files (top 10)"
+            echo
+            echo "| File | Bytes | KiB |"
+            echo "|---|---:|---:|"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          find "$chrome_dir" -type f -name "*.js" -printf '%s\t%p\n' \
+            | sort -nr \
+            | head -n 10 \
+            | while IFS=$'\t' read -r size path; do
+                echo "| ${path} | ${size} | $(awk "BEGIN {printf \"%.2f\", ${size}/1024}") |" >> "$GITHUB_STEP_SUMMARY"
+              done
+
   no-relevant-changes:
     needs: [should-run]
     if: >-

.github/workflows/release-extension.yml

@@ -10,13 +10,27 @@ permissions:
   contents: write
 
 jobs:
-  release:
+  build-and-test:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     defaults:
       run:
         working-directory: src/typescript
     env:
       DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -36,17 +50,23 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Install Playwright Chromium
+        run: pnpm --filter @openerrata/extension exec playwright install --with-deps chromium
+
       - name: Generate Prisma client
         run: pnpm db:generate
 
       - name: Typecheck
         run: pnpm typecheck
 
       - name: Lint and dead-code checks
-        run: pnpm lint && pnpm knip
+        run: pnpm lint && pnpm knip && pnpm format:check
+
+      - name: Run full test suite
+        run: pnpm test
 
-      - name: Run extension tests
-        run: pnpm run test:unit:shared && pnpm run test:unit:extension
+      - name: Run coverage checks
+        run: pnpm test:coverage
 
       - name: Build extension
         run: pnpm --filter @openerrata/extension build
@@ -61,28 +81,85 @@ jobs:
             echo "version=$(date +%Y%m%d)-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Package extension zip
+      - name: Package Chrome extension zip
         run: |
           cd extension/dist
-          zip -r "$GITHUB_WORKSPACE/openerrata-extension-${{ steps.version.outputs.version }}.zip" .
+          zip -r "$GITHUB_WORKSPACE/openerrata-extension-chrome-${{ steps.version.outputs.version }}.zip" .
+
+      - name: Package Firefox extension zip
+        run: |
+          cd extension/dist/firefox
+          zip -r "$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip" .
+
+      - name: Enforce bundle size hard limit
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          chrome_zip="$GITHUB_WORKSPACE/openerrata-extension-chrome-${{ steps.version.outputs.version }}.zip"
+          firefox_zip="$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip"
+          limit_bytes=5242880
+
+          chrome_bytes="$(stat -c%s "$chrome_zip")"
+          firefox_bytes="$(stat -c%s "$firefox_zip")"
+
+          if [ "$chrome_bytes" -gt "$limit_bytes" ]; then
+            echo "Chrome zip exceeds 5 MiB: ${chrome_bytes} bytes"
+            exit 1
+          fi
+
+          if [ "$firefox_bytes" -gt "$limit_bytes" ]; then
+            echo "Firefox zip exceeds 5 MiB: ${firefox_bytes} bytes"
+            exit 1
+          fi
+
+      - name: Verify Firefox zip integrity
+        run: unzip -t "$GITHUB_WORKSPACE/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip"
+
+      - name: Lint Firefox extension package
+        run: npx -y web-ext@8.9.0 lint --source-dir extension/dist/firefox
+
+      - name: Upload packaged zips
+        uses: actions/upload-artifact@v4
+        with:
+          name: openerrata-extension-zips-${{ steps.version.outputs.version }}
+          path: |
+            ${{ github.workspace }}/openerrata-extension-chrome-${{ steps.version.outputs.version }}.zip
+            ${{ github.workspace }}/openerrata-extension-firefox-${{ steps.version.outputs.version }}.zip
+
+  release:
+    needs: [build-and-test]
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download packaged zips
+        uses: actions/download-artifact@v4
+        with:
+          name: openerrata-extension-zips-${{ needs.build-and-test.outputs.version }}
+          path: .
 
       - name: Create GitHub Release
-        if: github.ref_type == 'tag'
         uses: softprops/action-gh-release@v2
         with:
-          files: openerrata-extension-${{ steps.version.outputs.version }}.zip
+          files: |
+            openerrata-extension-chrome-${{ needs.build-and-test.outputs.version }}.zip
+            openerrata-extension-firefox-${{ needs.build-and-test.outputs.version }}.zip
           generate_release_notes: true
 
-      - name: Upload artifact (non-tag builds)
-        if: github.ref_type != 'tag'
-        uses: actions/upload-artifact@v4
+  publish:
+    needs: [build-and-test, release]
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    environment: extension-store-publish
+    steps:
+      - name: Download packaged zips
+        uses: actions/download-artifact@v4
         with:
-          name: openerrata-extension-${{ steps.version.outputs.version }}
-          path: openerrata-extension-${{ steps.version.outputs.version }}.zip
+          name: openerrata-extension-zips-${{ needs.build-and-test.outputs.version }}
+          path: .
 
       - name: Publish to Chrome Web Store
         if: >-
-          github.ref_type == 'tag' &&
           env.CHROME_EXTENSION_ID != '' &&
           env.CHROME_CLIENT_ID != '' &&
           env.CHROME_CLIENT_SECRET != '' &&
@@ -94,9 +171,25 @@ jobs:
           CHROME_REFRESH_TOKEN: ${{ secrets.CHROME_REFRESH_TOKEN }}
         run: |
           npx -y chrome-webstore-upload-cli@3 upload \
-            --source "$GITHUB_WORKSPACE/openerrata-extension-${{ steps.version.outputs.version }}.zip" \
+            --source "openerrata-extension-chrome-${{ needs.build-and-test.outputs.version }}.zip" \
             --extension-id "$CHROME_EXTENSION_ID" \
             --client-id "$CHROME_CLIENT_ID" \
             --client-secret "$CHROME_CLIENT_SECRET" \
             --refresh-token "$CHROME_REFRESH_TOKEN" \
             --auto-publish
+
+      - name: Publish to Firefox Add-ons
+        if: >-
+          env.FIREFOX_JWT_ISSUER != '' &&
+          env.FIREFOX_JWT_SECRET != ''
+        env:
+          FIREFOX_JWT_ISSUER: ${{ secrets.FIREFOX_JWT_ISSUER }}
+          FIREFOX_JWT_SECRET: ${{ secrets.FIREFOX_JWT_SECRET }}
+        run: |
+          mkdir -p firefox-upload
+          unzip -q "openerrata-extension-firefox-${{ needs.build-and-test.outputs.version }}.zip" -d firefox-upload
+          npx -y web-ext@8.9.0 sign \
+            --source-dir firefox-upload \
+            --api-key "$FIREFOX_JWT_ISSUER" \
+            --api-secret "$FIREFOX_JWT_SECRET" \
+            --channel listed

.gitignore

@@ -9,6 +9,7 @@ src/typescript/api/src/lib/generated/prisma/
 
 # Build artifacts
 *.tsbuildinfo
+**/coverage/
 src/typescript/extension/test-results/
 src/typescript/extension/playwright-report/
 

README.md

@@ -32,14 +32,18 @@ inspectable by users.
 
 **Chrome Web Store** — Coming soon.
 
+**Firefox Add-ons (AMO)** — Coming soon.
+
 **Manual install** from [GitHub Releases](https://github.com/ZeroPathAI/openerrata/releases):
 
-1. Download the latest `openerrata-extension-*.zip` from the [Releases page](https://github.com/ZeroPathAI/openerrata/releases)
+1. Download the latest browser-specific zip from the [Releases page](https://github.com/ZeroPathAI/openerrata/releases):
+   - Chrome: `openerrata-extension-chrome-*.zip`
+   - Firefox: `openerrata-extension-firefox-*.zip`
 2. Unzip the file
-3. Open `chrome://extensions` in Chrome
-4. Enable **Developer mode** (toggle in the top-right)
-5. Click **Load unpacked** and select the unzipped folder
-6. (Optional) Set your [OpenAI API Key](https://developers.openai.com/api/docs/quickstart) in the settings 
+3. Install by browser:
+   - Chrome: open `chrome://extensions`, enable **Developer mode**, then click **Load unpacked** and select the unzipped folder.
+   - Firefox: open `about:debugging#/runtime/this-firefox`, click **Load Temporary Add-on...**, then choose the extension `manifest.json` in the unzipped folder.
+4. (Optional) Set your [OpenAI API Key](https://developers.openai.com/api/docs/quickstart) in the settings 
 
 Errata are first pulled from the public instance before being regenerated. If
 you do not have an OpenAI API key, you can receive the errata generated by
@@ -91,7 +95,7 @@ src/
 └── typescript/
     ├── shared/              # @openerrata/shared — types, Zod schemas, normalization
     ├── api/                 # @openerrata/api — SvelteKit + tRPC backend, Prisma, job queue
-    ├── extension/           # @openerrata/extension — Chrome MV3 browser extension
+    ├── extension/           # @openerrata/extension — WebExtension (Chrome + Firefox)
     └── pulumi/              # @openerrata/pulumi — deploys the Helm chart for hosted env
 ```
 
@@ -156,11 +160,19 @@ pnpm db:generate         # Regenerate Prisma client
 
 ### Loading the Extension
 
-After `pnpm dev:ext`, load the built extension as an unpacked extension in Chrome:
+After `pnpm dev:ext`, load the built extension as an unpacked extension:
+
+1. Chrome:
+   - Navigate to `chrome://extensions`
+   - Enable "Developer mode"
+   - Click "Load unpacked" and select `src/typescript/extension/dist`
+2. Firefox:
+   - Navigate to `about:debugging#/runtime/this-firefox`
+   - Click "Load Temporary Add-on..."
+   - Select `src/typescript/extension/dist/firefox/manifest.json`
 
-1. Navigate to `chrome://extensions`
-2. Enable "Developer mode"
-3. Click "Load unpacked" and select the extension build output directory
+For signed Firefox releases, set `FIREFOX_GECKO_ID=<your-addon-id>` before
+building to control the generated `browser_specific_settings.gecko.id`.
 
 ## Deployment