update

.gitignore

@@ -2,6 +2,7 @@ bundle/
 autoload/
 undodir/*
 .vimtmp/*
+legacy/.vimtmp/
 view/*
 tmpdir
 WORKSPACE_TEST/

AGENTS.md

@@ -107,7 +107,7 @@ This repository is being migrated to a modern, minimal Neovim setup driven by Lu
 - Spell & text: `spelllang=en_gb`, custom `listchars`, `showbreak`.
 - Keyword characters: `iskeyword+=$` (for PHP/shell variables), `iskeyword+=-` (for CSS/HTML/config files).
 
-## Current Status (Phase 10 Complete)
+## Current Status (Phase 12 In Progress)
 - ✅ Phase 1-2: Archive legacy, bootstrap lazy.nvim
 - ✅ Phase 3: Core editing & LSP (native exrc + vim.lsp.config migration complete)
 - ✅ Phase 4: Navigation (Telescope, netrw, Oil.nvim)
@@ -117,7 +117,8 @@ This repository is being migrated to a modern, minimal Neovim setup driven by Lu
 - ✅ Phase 8: Copilot integration (copilot.lua + copilot-cmp)
 - ✅ Phase 9: Formatting & Linting (conform.nvim, nvim-lint, Mason tool installer)
 - ✅ Phase 10: Migrate kept behaviors (abbreviations, templates, custom Treesitter queries)
-- ⏸️ Phase 11: Cleanup & validation (pending)
+- ✅ Phase 11: Modern Paper Tonic colorscheme
+- ⏳ Phase 12: Cleanup and validation (repository cleanup and automated checks complete; interactive workflow checks remain)
 
 ## Migration Notes
 - Do not edit legacy Vimscript files except to extract settings to Lua. Keep them intact until migration completes.
@@ -138,7 +139,7 @@ This repository is being migrated to a modern, minimal Neovim setup driven by Lu
 - **Project-local config**: Native `exrc` + `secure` (no neoconf - incompatible with 0.11+)
 - **Config format**: `.nvim.lua` files return `{ lsp = { [server_name] = { settings = {...} } } }`
 - **Security**: `secure` mode prompts user to trust `.nvim.lua` files (one-time per file hash)
-- **Settings loading**: `on_new_config` hook loads from actual `root_dir` (not cwd)
+- **Settings loading**: `LspAttach` securely reads `.nvim.lua` from the client's actual `root_dir` (not cwd)
 - **PHP**: intelephense with `single_file_support = false`, uses `environment.includePaths` for external libs
 
 ### Navigation Strategy

LOG.md

@@ -76,7 +76,7 @@ Record every decision here with a short rationale. Append new entries; do not re
   - **Format-on-save**: Enabled by default, toggle with `<leader>lt`
   - **Manual format**: `<leader>lf` (buffer), `<leader>lf` (visual range)
   - **Linting split**: conform.nvim for formatting, nvim-lint for diagnostics (replaced none-ls after discovering phpcbf preprocessing bug)
-  - **Python support**: pyright LSP, black formatter, ruff linter, treesitter parser
+  - **Python support**: pyright LSP, ruff formatter/linter, treesitter parser (the original black plan was superseded)
   - **Per-filetype indentation**: Explicit settings per filetype to match formatters
     - PHP: tabs, 2-space display (WordPress standards)
     - JS/TS/CSS/JSON/HTML: 2 spaces (Prettier)
@@ -178,85 +178,40 @@ Record every decision here with a short rationale. Append new entries; do not re
   - **No overrides needed**: Modern implementation doesn't require separate override file
 - 2025-12-12: Added keymap reference documentation (now `README.md`) + `:KeymapsGuide` floating viewer to document every configured keymap (global + plugin-specific) grouped by source file.
 - 2025-12-12: nvim-cmp updated to disable auto-selection; confirm requires explicit item selection.
+- 2026-10-27: Phase 12 cleanup retired 607 tracked `.vimtmp` backup artifacts and a broken legacy Paper Tonic symlink while preserving the meaningful Vimscript archive. Added an ignore rule for the retired backup directory and corrected the legacy archive index.
+- 2026-10-27: Project `.nvim.lua` settings are now read with `vim.secure.read()` before evaluation. This closes the trust bypass caused by manually calling `dofile()` from the LSP attachment callback.
+- 2026-10-27: Validation confirmed a clean Neovim 0.11.5 headless launch in approximately 45 ms with 29 configured plugins. Formatter and language-server executables managed by Mason are present in Mason's bin directory; PHP tools and `lua-language-server` are available system-wide.
+- 2026-10-27: Repaired `test-diagnostics.lua` so its intentional unreachable-code example remains valid Lua and can be parsed by `lua_ls`.
+- 2026-10-27: Live validation confirmed Intelephense attaches in `WORKSPACE_TEST` and receives the trusted external `includePaths`. Conform reports prettier, phpcbf, and stylua available; nvim-lint resolves eslint_d, phpcs, and markdownlint.
+- 2026-10-27: Updated `AGENTS.md` status and LSP architecture notes to reflect completed colorscheme work and the current Phase 12 implementation.
+- 2026-10-27: Added Conform's built-in `ruff_format` for Python. Ruff was already Mason-managed for diagnostics; this closes a gap where documentation claimed Python formatting but format-on-save had no Python formatter and disabled LSP fallback.
 
-## Project-Local Configuration (design)
+## Project-Local Configuration
 
-Context: Projects can contain multiple git repositories (e.g., WordPress site with theme + multiple plugins). We need a way to set per-project `intelephense.includePaths` and similar without globalizing settings.
+The final implementation uses Neovim's native `exrc` support with `secure` enabled. A project's trusted `.nvim.lua` returns an `lsp` table keyed by server name. An `LspAttach` callback securely reads settings from the client's actual root directory and sends them with `workspace/didChangeConfiguration`, so settings do not depend on Neovim's current working directory.
 
-Options considered
-- Layered JSON files (recommended): `.nvim.json` (committed) + `.nvim.local.json` (gitignored)
-  - Walk upward from current file; collect and merge configs until reaching a boundary marker or filesystem root.
-  - Boundary marker: `.nvimroot` to define a workspace that can encompass multiple repos.
-  - Merge order: top → bottom; nearest wins on conflicts; arrays replace by default unless we later add a merge strategy.
-  - Pros: safe (data-only), portable, reviewable in PRs.
-  - Cons: less dynamic than Lua.
-- Layered Lua files: `.nvim.lua` + `.nvim.local.lua`
-  - Pros: maximum flexibility (computed paths).
-  - Cons: executes code from the repo; security gates required.
-- Env/direnv: rejected (decision 2025-12-06).
-- Central registry file in `~/.config/nvim/`: possible later for private overrides, but not primary.
+Example `.nvim.lua`:
 
-Chosen approach (confirmed)
-- Use `folke/neoconf.nvim` with `.neoconf.json` at the workspace root (or project roots) to supply LSP/plugin settings. Multi-repo: keep a single `.neoconf.json` at the parent workspace folder and open Neovim from there (or use a rooter later if needed).
-
-Example `.neoconf.json`
-```
-{
-  "lspconfig": {
-    "intelephense": {
-      "settings": {
-        "intelephense": {
-          "environment": {
-            "includePaths": [
-              "wp-content/themes/my-theme",
-              "wp-content/plugins/custom-plugin"
-            ]
-          }
-        }
-      }
-    }
-  }
-}
-```
-- Files recognized per directory level:
-  - `.nvim.json`: checked into VCS; shared per-project defaults.
-  - `.nvim.local.json`: gitignored; machine-specific overrides.
-- Loader behavior:
-  1. Start at the buffer’s directory; ascend toward root.
-  2. Stop at directory containing `.nvimroot` (if found) or at filesystem root.
-  3. At each level, if `.nvim.json` or `.nvim.local.json` exists, parse and stage for merge.
-  4. Merge staged configs in ascending order; nearest directory applies last.
-- Path resolution:
-  - Relative paths resolve against the topmost boundary (i.e., `.nvimroot` directory if present; otherwise the highest directory in which a config was found). This allows referencing sibling repos (e.g., theme and plugins) from a single top-level site folder.
-
-Example `.nvim.json`
-```
-{
-  "lsp": {
-    "php": {
-      "intelephense": {
-        "includePaths": [
+```lua
+return {
+  lsp = {
+    intelephense = {
+      settings = {
+        intelephense = {
+          environment = {
+            includePaths = {
               "wp-content/themes/my-theme",
               "wp-content/plugins/custom-plugin",
-          "vendor/some-package/src"
-        ]
-      }
-    }
-  }
+            },
+          },
+        },
+      },
+    },
+  },
 }
 ```
 
-Intended integration
-- A helper module `lua/local_config.lua` will expose:
-  - `load(start_dir) -> table` collecting and merging configs
-  - `get(path, default)` for reads, e.g., `get({"lsp","php","intelephense","includePaths"}, {})`
-- LSP wiring (in Phase 3.5):
-  - Read includePaths via the helper and pass to `settings.intelephense.environment.includePaths` in `lspconfig.intelephense.setup{}`.
-
-Open items to confirm
-- Confirm JSON as the format (vs Lua) for project-local config.
-- Confirm `.nvimroot` as the workspace boundary marker name.
-- Confirm array merge behavior (replace vs concatenate). Initial proposal: replace.
+Neoconf and the earlier layered JSON proposal were rejected. They remain in the chronological decision entries above only as superseded history.
 
 ## LSP Scope (initial)
 

MIGRATION_PLAN.md

@@ -64,7 +64,7 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 - [x] Confirm scope and priorities for this subphase
 - [x] Decision: Use native `exrc` + `secure` instead of neoconf (neoconf incompatible with Neovim 0.11+ vim.lsp.config API)
 - [x] Enable `exrc` and `secure` in settings.lua
-- [x] Implement `.nvim.lua` loader in LSP config using `on_new_config` hook
+- [x] Implement `.nvim.lua` loader in an `LspAttach` callback using the client's actual root directory
 - [x] Wire `intelephense.environment.includePaths` via `.nvim.lua`
 - [x] Create validation workspaces: `WORKSPACE_TEST/` and `EXTERNAL_TEST/` with sample PHP files
 - [x] Migrate to `vim.lsp.config()` and `vim.lsp.enable()` (Neovim 0.11+ native API)
@@ -74,18 +74,18 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 ## Phase 3.7 — Clean LSP config
 - [x] Remove debug/helper logic from LSP config
 - [x] Migrate from deprecated `require('lspconfig')[server].setup()` to `vim.lsp.config()` + `vim.lsp.enable()`
-- [x] Use `on_new_config` hook for project-local settings loading (loads from actual root_dir, not cwd)
+- [x] Use `LspAttach` for project-local settings loading (loads from actual root_dir, not cwd)
 
 ## Phase 3.8 — Validate project-local LSP settings
 - [x] Create test workspaces with `.nvim.lua` files
-- [x] Validate settings load from actual root_dir via `on_new_config` hook
+- [x] Validate settings load from the attached client's actual root_dir
 - [x] Verify `gd` works for external library references via `intelephense.environment.includePaths`
 - [x] Clean up debug code and notifications
 
 ## Phase 3.9 — Native exrc + vim.lsp.config migration (RESOLVED)
 - [x] Discovered neoconf incompatible with Neovim 0.11+ (GitHub issue #116, unresolved since May 2024)
 - [x] Migrated to native `exrc` + `secure` approach (zero dependencies, aligned with minimal philosophy)
-- [x] Implemented `.nvim.lua` loader using `on_new_config` hook (loads from actual root_dir)
+- [x] Implemented secure `.nvim.lua` loading during `LspAttach` (loads from actual root_dir)
 - [x] Migrated from deprecated `require('lspconfig')` framework to `vim.lsp.config()` + `vim.lsp.enable()`
 - [x] Root detection handled by nvim-lspconfig's native configs (no custom root_dir needed)
 - [x] Validated `gd` works for external library symbols via `intelephense.environment.includePaths`
@@ -99,7 +99,7 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 - [x] Add minimal LSP on-attach keymaps (gd, gr, K, gD, gI)
 - [x] Add global LSP keymaps with fallback in `lua/keymaps.lua`
 - [x] Intelephense: set `single_file_support=false`, root detection via nvim-lspconfig defaults
-- [x] Project settings loaded via `on_new_config` hook from `.nvim.lua` files
+- [x] Project settings securely loaded during `LspAttach` from `.nvim.lua` files
 
 ## Phase 3.6 — LSP server management (Mason)
 - [x] Confirm scope and priorities for this subphase
@@ -263,7 +263,7 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 
 ## Phase 9.1 — Confirm scope and priorities
 - [x] Confirm scope and priorities for this phase
-- [x] Decision: Formatters - prettier (JS/TS/CSS/JSON/MD/HTML), phpcbf (PHP), stylua (Lua), black (Python)
+- [x] Decision: Formatters - prettier (JS/TS/CSS/JSON/MD/HTML), phpcbf (PHP), stylua (Lua), ruff_format via conform (Python; supersedes the original black plan)
 - [x] Decision: Linters - eslint (JS/TS), phpcs (PHP), markdownlint (Markdown), ruff (Python)
 - [x] Decision: Project-local executables preferred, fallback to global (node_modules/.bin/, vendor/bin/)
 - [x] Decision: phpcs/phpcbf already installed globally with WordPress coding standards - no installation needed
@@ -295,7 +295,7 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 
 ## Phase 9.3 — Mason formatter/linter installation
 - [x] Add `WhoIsSethDaniel/mason-tool-installer.nvim` for automated installation
-- [x] Install via Mason: prettier, eslint_d, markdownlint, stylua, black, ruff
+- [x] Install via Mason: prettier, eslint_d, markdownlint, stylua, and ruff
 - [x] Note: phpcs/phpcbf already installed globally, skip Mason installation
 - [x] Verify all tools available: Tools installed to ~/.local/share/nvim/mason/bin/
 
@@ -417,7 +417,7 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
   - HTML: @ClassNameAttribute, @IdAttribute, @DataAttribute (all fg_weak for attribute names)
   - HTML: @DataAttributeValue (Function)
   - Cross-language: class values and #id values in HTML use same colors as CSS selectors
-- [ ] Test with existing custom queries (after/queries/css/highlights.scm, after/queries/html/highlights.scm)
+- [x] Test with existing custom queries (after/queries/css/highlights.scm, after/queries/html/highlights.scm)
 
 ## Phase 11.8 — Plugin highlight groups
 - [x] Create `lua/paper-tonic-modern/groups/lsp.lua`
@@ -453,11 +453,11 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 - Colorscheme loads correctly: `vim.g.colors_name = 'paper-tonic-modern'`
 
 ## Phase 11.10 — Validation and polish
-- [ ] Test all primary languages (Lua, PHP, HTML, CSS, JS, Markdown)
-- [ ] Verify semantic consistency (CSS classes in HTML match CSS files)
-- [ ] Check plugin UI colors (Telescope, Gitsigns, nvim-cmp)
-- [ ] Verify LSP diagnostics are visible and distinct
-- [ ] Document color scheme in README
+- [x] Test all primary language parsers (Lua, PHP, HTML, CSS, JS, Markdown)
+- [x] Verify semantic highlight captures for matching CSS/HTML classes and IDs load correctly
+- [x] Check configured plugin UI highlight groups (Telescope, Gitsigns, nvim-cmp)
+- [x] Verify LSP diagnostic highlight groups are defined and distinct
+- [x] Document color scheme in README
 
 ## Phase 11.11 — Extract to separate repo (later)
 - [ ] Move to `~/projects/paper-tonic-modern/`
@@ -468,13 +468,15 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 ## Phase 12 — Cleanup & Validation
 
 ## Phase 12.1 — Confirm scope and priorities
-- [ ] Confirm scope and priorities for this phase
+- [x] Confirm scope and priorities for this phase
 
 ## Phase 12.2 — Retire legacy files
-- [ ] Retire legacy Vimscript files (keep for reference until verified)
+- [x] Retire tracked `.vimtmp` backup artifacts and prevent them from being re-added
+- [x] Retire the broken `legacy/paper-tonic-original` symlink
+- [x] Keep the meaningful legacy Vimscript archive as historical reference
 
 ## Phase 12.3 — Startup performance
-- [ ] Validate startup performance (no errors, fast launch)
+- [x] Validate startup performance (clean headless launch in approximately 45 ms on 2026-10-27)
 
 ## Phase 12.4 — Navigation validation
 - [ ] Validate Telescope navigation + LSP jumps
@@ -488,10 +490,13 @@ Source of truth for the step-by-step rebuild. Keep this concise and up to date.
 - [ ] Verify LSP (gd, gr, K, diagnostics)
 - [ ] Verify formatting (prettier, phpcbf, stylua)
 - [ ] Verify linting (eslint_d, phpcs, markdownlint)
+- [x] Confirm primary Tree-sitter parsers and HTML/CSS custom queries load
+- [x] Confirm Intelephense attaches with secure project-local includePaths
+- [x] Confirm configured formatter and linter executables resolve
 
 ## Phase 12.6 — Final polish
 - [x] Review all keymaps and ensure they're documented (README.md + :KeymapsGuide)
-- [ ] Update LOG.md with final architecture and usage
+- [x] Update LOG.md with final architecture and usage
 - [ ] Clean up any remaining debug code or temporary comments
 
 ---
@@ -511,5 +516,5 @@ Decisions & Changes:
 - **vim.lsp.config migration**: Migrated from deprecated `require('lspconfig')[server].setup()` to `vim.lsp.config()` + `vim.lsp.enable()` (Neovim 0.11+ native API).
 - **Project config format**: `.nvim.lua` files return `{ lsp = { [server_name] = { settings = {...} } } }`.
 - **Security model**: `secure` mode prompts user to trust `.nvim.lua` files before execution (one-time per file hash).
-- **Settings loading**: `on_new_config` hook loads project settings from actual `root_dir` (not cwd), ensuring correct behavior across different workspace structures.
+- **Settings loading**: An `LspAttach` callback securely reads project settings from the client's actual `root_dir` (not cwd), ensuring correct behavior across different workspace structures.
 - **Phase 4 Navigation Strategy**: Skipped Neo-tree in favor of built-in netrw for visual context and project structure browsing. Telescope for fuzzy finding. Oil.nvim for file manipulation (evaluation phase; alternative is mini.files). Rationale: User needs visual context and preview, not per-tab roots or complex tree features. File manipulation primarily done in shell, but Oil.nvim handles buffer sync issues when renaming/moving files.

README.md

@@ -358,7 +358,7 @@ Buffer-local keymaps available when inside a git repository:
 | Mode | Key | Description |
 | --- | --- | --- |
 | insert | `<C-Space>` | Manually trigger completion |
-| insert | `<CR>` | Confirm selection (selects first item by default) |
+| insert | `<CR>` | Confirm the explicitly selected completion item |
 | insert | `<C-n>` | Next completion item |
 | insert | `<C-p>` | Previous completion item |
 | insert | `<C-e>` | Abort completion menu |
@@ -373,6 +373,32 @@ Buffer-local keymaps available when inside a git repository:
 
 ## Configuration
 
+### Colorscheme
+
+`paper-tonic-modern` is built into this repository and loaded from `colors/paper-tonic-modern.lua`. Its modular highlight definitions live under `lua/paper-tonic-modern/` and cover the editor UI, traditional syntax, Tree-sitter captures, LSP diagnostics, and the configured plugins.
+
+The theme follows the system light/dark preference at startup. Use `<leader>bg` to toggle the background manually. Custom HTML and CSS Tree-sitter queries keep matching classes and IDs visually consistent across both languages.
+
+### Project-Local LSP Settings
+
+Native `exrc` and `secure` support are enabled. A trusted `.nvim.lua` can return an `lsp` table keyed by server name; settings are securely read from the attached LSP client's root and sent through `workspace/didChangeConfiguration`.
+
+```lua
+return {
+  lsp = {
+    intelephense = {
+      settings = {
+        intelephense = {
+          environment = {
+            includePaths = { "vendor/package/src" },
+          },
+        },
+      },
+    },
+  },
+}
+```
+
 ### Formatting & Linting
 
 This config uses **conform.nvim** for formatting and **nvim-lint** for diagnostics. Both prefer project-local tools over global installations.
@@ -393,7 +419,7 @@ Conform.nvim handles this resolution automatically via its built-in `util.find_e
 - **JavaScript/TypeScript/CSS/JSON/HTML/Markdown**: `prettier`
 - **PHP**: `phpcbf` (WordPress standard by default)
 - **Lua**: `stylua`
-- **Python**: handled by `ruff` LSP (not conform)
+- **Python**: `ruff_format`
 
 **Linters** (`lua/plugins/nvim-lint.lua`):
 - **JavaScript/TypeScript**: `eslint_d`