Add WhereData module: persistence, GPS, evidence, simulated-year tests

[kyleve]

Summary

Data foundation for the Where app. No UI changes; this PR is purely the model/persistence/ingestion layer that future feature work will build on.

• WhereController actor orchestrates GPS ingestion, retroactive day entry, evidence attachments, and year reports. Sits behind a WhereStore protocol (transactional perform { ... } API) and a LocationSource protocol (requestPermission() + liveSamples async stream).
• Production SwiftDataStore: @ModelActor over a ModelContainer, with a per-perform peer ModelContext for writes so the main context is effectively read-only and write transactions are atomic (commit on success, rollback on throw). Container mode is Storage.default → .inMemory under tests, .localOnly in DEBUG, .cloudKit in release.
• CoreLocationSource wraps CLLocationManager (Visits + significant-change). requestPermission() is async throws and reuses the CLLocationManagerDelegate authorization callback via CheckedContinuation. ScriptedLocationSource test double drives deterministic samples.
• EvidenceBlobStore protocol kept separate from WhereStore so blob storage can be swapped later. SwiftDataStore implements both, with @Attribute(.externalStorage) so CloudKit chunks blobs as CKAssets.
• Domain types in WhereCore: Region, Coordinate, LocationSample, DayPresence, YearReport, Evidence / EvidenceKind / EvidenceContentType, SampleSource. Region is generalized beyond US states (CA, NY, Canada, EU, other); EvidenceKind and EvidenceContentType are associated-value enums with .other(String?) for catch-all labels; SampleSource.evidenceImplied(id:kind:) carries provenance back to the originating Evidence row.
• RegionAttributor.shared (loaded from bundled GeoJSON) with a per-region BoundingBox pre-pass before the even-odd ray-cast. GeoJSON primitives live in their own GeoJSON namespace enum (separation from the attributor).
• Bundled polygons under Where/WhereCore/Sources/Resources/:
  • us-states.geojson — US Census 5m simplified state polygons (CA + NY indexed by feature NAME; credited in Resources/README.md).
  • canada.geojson, europeanUnion.geojson — per-region hand-bundled simplified polygons.
• Localizable.xcstrings for user-facing region names; Region.localizedName is a switch with literal String(localized:) keys per case so the string-catalog extractor can see every key statically.
• Tooling/conventions in AGENTS.md: no proactive PR-feedback action, CI polling stays in a subagent (local tests still block), one-commit-per-todo with passing tests, --no-open for tuist generate, prefer named structs over multi-field tuples. .swiftformat tightened to --max-width 100 with --allow-partial-wrapping false so multi-arg signatures wrap one-per-line. ./ide takes --no-open.

Out of scope

• All UI work (calendar, year, day-detail views, GPS permission UI). RootView and the Where app are unchanged beyond Tuist/SPM wiring.
• Higher-fidelity polygons beyond the bundled US Census 5m + hand-bundled CA/EU. The current set is good enough for the cities our tests spot-check.

Test plan

10 suites across 4 bundles (WhereCoreTests, StuffCoreTests, WhereTests, WhereUITests), all green on iPhone 17 / iOS 26.2:

• DayAggregatorTests — single-region, dual-region cross-country, transatlantic midnight, Mexico stopover (.other), empty input, calendar/timezone edges, year filtering.
• RegionAttributorTests — positive spot-checks (SF, LA, NYC, Buffalo, Toronto, Montreal, Paris, Berlin) and negatives (Reno, Newark, Tijuana, London, Chicago, Tokyo).
• SimulatedYearTests — full simulated 2026 with CA-heavy residency, several flights, one Canada trip, one EU trip, a 7-day no-GPS gap, retroactive backfill, evidence attachments.
• NewYorkHeavyYearTests — mirror of SimulatedYear weighted toward NY, plus bare-majority (1-day margin) and 8-week alternation scenarios.
• WhereControllerTests — ingest/manual/evidence round-trips, retry queue (bounded FIFO with ToggleFailingStore fault injection), manual-day upsert, per-perform rollback (throwing block discards staged writes), read-your-own-writes inside perform, peer-save visible to main read context.
• YearReportTests — day sort ordering.
• StorageDefaultTests — SwiftDataStore.Storage.default == .inMemory under the test runner (env-var detection so a future runner change can't silently let tests write to disk).
• RegionTests — localizedName returns the catalog English value for each case.
• EvidenceKindTests / SampleSourceTests — synthesized Codable round-trip + denormalized provenance accessors.

Verification commands:

./swiftformat --lint                  # clean
mise exec -- tuist test               # all bundles, full simulator run

Notes

• Codable wire format: YearReport.totals custom-encodes as [String: Int] keyed by Region.rawValue so JSONEncoder.sortedKeys produces deterministic output (Swift's default for [Region: Int] would emit an unkeyed array). EvidenceKind / EvidenceContentType / SampleSource use synthesized Codable (nested per-case shape, e.g. {"other":{"_0":"label"}}) — no manual init(from:) / encode(to:).
• No InMemoryStore: an earlier iteration had a hand-written in-memory store; it's gone in favor of SwiftDataStore.inMemory() so tests exercise the same persistence path as production.
• swift-snapshot-testing 1.19.2 is still in Package.swift even though no test currently uses it — kept for upcoming work that wants snapshot coverage of YearReport or UI artifacts.
• Plans/ is git-ignored. Implementation plans live there during the work and aren't committed.
• New .agents/skills/ committed: swift-testing-pro, swift-concurrency-pro, swiftdata-pro, swiftui-pro.

Made with Cursor

[kyleve]

@cursoragent review

[cursor]

Findings:

• High — CloudKit-backed SwiftDataStore schema is not CloudKit-compatible. SwiftDataStore.makeContainer defaults useCloudKit to true, but the models use @Attribute(.unique) and non-optional properties without defaults (SwiftDataStore.swift:23-29, :176-183, :212-219, :248-251). SwiftData/CloudKit cannot enforce unique constraints and requires CloudKit-compatible defaults/optionals, so the production container can fail to open or sync. Remove unique annotations, enforce uniqueness in store methods, and add defaults or make fields optional as appropriate.

• High — Updating evidence metadata can permanently delete the attachment blob. WhereController.addEvidence(_:blob:) defaults blob to nil (WhereController.swift:58), while both stores replace the existing record with that exact blob value (SwiftDataStore.swift:62-79, InMemoryStore.swift:27-29). A note/kind/region edit without resupplying bytes wipes the stored attachment. Preserve the existing blob when blob == nil, or split create/update semantics explicitly.

• Medium — GPS ingestion silently drops persistence failures. The GPS loop uses try? await store.addSample(sample) (WhereController.swift:95-99), so SwiftData save failures, duplicate IDs, CloudKit errors, or container issues are invisible and data is lost while tracking appears healthy. Surface/log failures and consider a retry/error stream instead of swallowing them.

• Medium — CLLocationManager is used without main-thread/main-actor confinement. CoreLocationSource constructs and drives CLLocationManager from a non-@MainActor Sendable class (CoreLocationSource.swift:19-44, :52-53). Since callers can invoke this from WhereController’s actor, manager setup/start/request calls may occur off the main run loop. Mark the source or its CoreLocation-facing methods @MainActor.

• Medium — Visit samples with unknown arrival dates can be assigned to the wrong day. When CLVisit.arrivalDate == .distantPast, the code uses Date() (CoreLocationSource.swift:87-105). Deferred visit delivery can then attribute a historical visit to “today”; prefer a valid departureDate when available or skip/flag unknown-timestamp visits.

• Low/Medium — Bundled region resource failures are silent in release. Missing or malformed GeoJSON is skipped with only assertionFailure on decode (RegionAttributor.swift:33-40), causing whole regions to become .other in production. Since these resources are required for correctness, fail loudly or make loading throwing.

Tests not run; this was a static PR review.

  

[kyleve]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1eb60d4409

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyleve]

Posted by an AI agent on @kyleve's behalf.

Addressed the review findings in ba1c9ee:

• High — CloudKit-incompatible SwiftData schema. Removed @Attribute(.unique) from SDLocationSample, SDEvidence, and SDManualDay and gave every stored property a default value so the schema works with CloudKit's mirror. Uniqueness is now enforced inside SwiftDataStore's add… methods (fetch-then-delete-then-insert), including addSample which previously didn't dedupe.
• High — addEvidence wiping attachments. Both SwiftDataStore.addEvidence and InMemoryStore.addEvidence now treat blob: nil as "no change" — they look up the existing blob and preserve it. Callers that need to explicitly remove a blob should use EvidenceBlobStore.delete(for:).
• Medium — GPS persistence failures silently dropped. WhereController.startGPS now logs failures via os.Logger (com.stuff.where / WhereController) instead of try?. The stream keeps running so a transient error doesn't stop tracking, but the failure is visible in Console / os_log.
• Medium — CLLocationManager actor confinement. CoreLocationSource is now @MainActor. AsyncStream lets and continuations are nonisolated (AsyncStream.Continuation.yield is thread-safe). CLLocationManagerDelegate methods are nonisolated so the conformance doesn't cross actors, while manager setup, start/stop, and authorization calls all run on the main run loop where CoreLocation expects them.
• Medium — Visit with unknown arrival date. locationManager(_:didVisit:) now uses visit.arrivalDate when valid, falls back to visit.departureDate, and only resorts to Date() if both are .distantPast. (Also responded inline.)
• Low/Medium — Silent bundled region resource failures. RegionAttributor.loadFromBundle now logs missing or unparseable GeoJSON via Logger.fault (com.stuff.where / RegionAttributor) so it's visible in release Console output, in addition to the existing assertionFailure for debug builds.

Tests pass locally via mise exec -- tuist test --no-selective-testing -- -destination 'platform=iOS Simulator,name=iPhone 17,OS=26.2'.