Codex/harden edge pi5 launch gate

.github/workflows/ci.yml

@@ -55,7 +55,6 @@ jobs:
 
     - name: Security Audit
       working-directory: apps/web
-      continue-on-error: true
       run: npm audit --audit-level=critical --omit=dev
 
     - name: Generate Prisma Client
@@ -64,7 +63,7 @@ jobs:
 
     - name: Setup Database Schema
       working-directory: apps/web
-      run: npx prisma db push --config prisma/prisma.config.ts --schema prisma/schema.prisma --skip-generate
+      run: npx prisma migrate deploy --config prisma/prisma.config.ts --schema prisma/schema.prisma
       env:
         DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
         DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
@@ -73,6 +72,30 @@ jobs:
       working-directory: apps/web
       run: npm run typecheck
 
+    - name: Lint
+      working-directory: apps/web
+      run: npm run lint
+
+    - name: Unit Tests
+      working-directory: apps/web
+      run: npm run test:unit
+      env:
+        DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
+        DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
+        NEXTAUTH_SECRET: ci-secret-not-real
+        NEXTAUTH_URL: http://localhost:3000
+        REDIS_URL: "redis://localhost:6379"
+
+    - name: Coverage Gate
+      working-directory: apps/web
+      run: npm run test:coverage
+      env:
+        DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
+        DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_ci"
+        NEXTAUTH_SECRET: ci-secret-not-real
+        NEXTAUTH_URL: http://localhost:3000
+        REDIS_URL: "redis://localhost:6379"
+
     - name: Build
       working-directory: apps/web
       run: npm run build
@@ -90,6 +113,30 @@ jobs:
     name: API Strict Typecheck (apps/api)
     runs-on: ubuntu-22.04
 
+    services:
+      postgres:
+        image: ankane/pgvector:latest
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: craftmyfunnel_api_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
     steps:
     - uses: actions/checkout@v4
 
@@ -108,7 +155,14 @@ jobs:
 
     - name: Generate Prisma Client
       working-directory: apps/api
-      run: DATABASE_URL="postgresql://postgres:postgres@localhost:5432/dummy" DIRECT_URL="postgresql://postgres:postgres@localhost:5432/dummy" npx prisma generate --config prisma/prisma.config.ts --schema prisma/schema.prisma
+      run: DATABASE_URL="postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci" DIRECT_URL="postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci" npx prisma generate --config prisma/prisma.config.ts --schema prisma/schema.prisma
+
+    - name: Setup API Database Schema
+      working-directory: apps/api
+      run: npx prisma migrate deploy --config prisma/prisma.config.ts --schema prisma/schema.prisma
+      env:
+        DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci"
+        DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci"
 
     - name: Type Check
       working-directory: apps/api
@@ -118,6 +172,14 @@ jobs:
       working-directory: apps/api
       run: npm run build
 
+    - name: API Tests
+      working-directory: apps/api
+      run: npm run test
+      env:
+        DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci"
+        DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/craftmyfunnel_api_ci"
+        REDIS_URL: "redis://localhost:6379"
+
   docker-smoke:
     name: Docker Build Smoke (api required, edge-fastapi optional)
     runs-on: ubuntu-22.04

.github/workflows/playwright.yml

@@ -48,11 +48,11 @@ jobs:
     - name: Install dependencies
       run: npm ci --workspace apps/web --include-workspace-root --no-audit --no-fund --legacy-peer-deps
 
-    - name: Generate Prisma Client & Push Schema
+    - name: Generate Prisma Client & Apply Migrations
       working-directory: apps/web
       run: |
         npx prisma generate --config prisma/prisma.config.ts --schema prisma/schema.prisma
-        npx prisma db push --config prisma/prisma.config.ts --schema prisma/schema.prisma
+        npx prisma migrate deploy --config prisma/prisma.config.ts --schema prisma/schema.prisma
       env:
         DATABASE_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
         DIRECT_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
@@ -71,6 +71,7 @@ jobs:
         DATABASE_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
         DIRECT_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
         NEXTAUTH_SECRET: ci-playwright-secret
+        METRICS_TOKEN: ci-metrics-token
         NEXTAUTH_URL: http://localhost:3000
         NEXT_PUBLIC_API_URL: http://localhost:3001
         REDIS_URL: redis://localhost:6379
@@ -81,12 +82,13 @@ jobs:
 
     - name: Run Playwright tests
       working-directory: apps/web
-      run: npx playwright test
+      run: npx playwright test e2e/auth.spec.ts e2e/dashboard.spec.ts
       env:
         DATABASE_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
         DIRECT_URL: postgresql://postgres:password@localhost:5432/craftmyfunnel
         NEXTAUTH_SECRET: ci-playwright-secret
         NEXTAUTH_URL: http://localhost:3000
+        METRICS_TOKEN: ci-metrics-token
         TEST_USER_EMAIL: audit_user@example.com
         TEST_USER_PASSWORD: AuditPassword123!
         REDIS_URL: redis://localhost:6379

.github/workflows/production-gate.yml

@@ -62,11 +62,31 @@ jobs:
 
       - name: Setup Database
         working-directory: apps/web
-        run: npx prisma db push --config prisma/prisma.config.ts --schema prisma/schema.prisma
+        run: npx prisma migrate deploy --config prisma/prisma.config.ts --schema prisma/schema.prisma
         env:
           DATABASE_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
           DIRECT_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
 
+      - name: Run Unit Tests
+        working-directory: apps/web
+        run: npm run test:unit
+        env:
+          DATABASE_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
+          DIRECT_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
+          NEXTAUTH_SECRET: ci-secret
+          NEXTAUTH_URL: http://localhost:3000
+          REDIS_URL: "redis://localhost:6379"
+
+      - name: Run Coverage Gate
+        working-directory: apps/web
+        run: npm run test:coverage
+        env:
+          DATABASE_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
+          DIRECT_URL: "postgresql://postgres:password@localhost:5432/craftmyfunnel"
+          NEXTAUTH_SECRET: ci-secret
+          NEXTAUTH_URL: http://localhost:3000
+          REDIS_URL: "redis://localhost:6379"
+
       - name: Seed Readiness Data
         working-directory: apps/web
         run: npm run readiness:seed
@@ -84,6 +104,7 @@ jobs:
           REDIS_URL: "redis://localhost:6379"
           NEXTAUTH_SECRET: ci-secret
           NEXTAUTH_URL: http://localhost:3000
+          METRICS_TOKEN: ci-metrics-token
           NODE_ENV: production
           GEMINI_API_KEY: "ci-dummy-key"
 

AGENTS.md

@@ -2,35 +2,37 @@
 
 This repo is a monorepo with multiple deployable apps. Treat each app as a separate service.
 
-## What runs where
+## What Runs Where
 
-- `apps/web` - Next.js web app (UI + Next route handlers)
+- `apps/web` - Next.js web app (UI plus selected route handlers)
 - `apps/api` - Fastify API (loads Next-style `routes/**/route.ts` handlers via an adapter)
 - `apps/edge-fastapi` - optional private edge runtime
-- Shared packages live in `packages/*`
+- shared packages live in `packages/*`
 
-## Local dev quick path
+## Local Dev Quick Path
 
 - Start Postgres + Redis + Web + API: `npm run beta:start`
 - Start Postgres + Redis + Web + API + Edge: `npm run beta:start:all`
 
-## Prisma + Redis expectations
+## Prisma And Redis Expectations
 
-- Postgres is required for real app functionality (auth, data, workflows).
+- Postgres is required for real app functionality: auth, data, workflows, readiness checks.
 - Redis is optional for cache/queue features; the app should boot without Redis.
-- In CI/build-only environments, avoid hard requirements on Redis/Postgres unless the workflow explicitly provisions them.
+- In CI and build-only environments, avoid hard requirements on Redis/Postgres unless the workflow explicitly provisions them.
 
 ## CI / GitHub Actions
 
-- If a workflow needs Postgres/Redis, use GitHub Actions `services:` containers and run `prisma db push` (ephemeral DB) before tests/build steps.
+- If a workflow needs Postgres/Redis, use GitHub Actions `services:` containers and run the required Prisma setup before tests/build steps.
 - Defaulting to `redis://localhost:6379` is fine for local dev, but must not cause CI failures when Redis is not provisioned.
+- Do not treat a local pass as the final truth for launch readiness until GitHub Actions is green on the target branch.
 
-## Editing guidance
+## Editing Guidance
 
-- Keep changes scoped to the app you're touching (`apps/web` vs `apps/api`).
+- Keep changes scoped to the app you are touching (`apps/web` vs `apps/api` vs `apps/edge-fastapi`).
 - Prefer graceful degradation for optional infra (Redis) and fail-fast for required infra (`DATABASE_URL` in production/runtime).
+- Do not silently preserve stale docs if the runtime shape changed; update the matching docs in the same run when possible.
 
-## AI Guardrail and Credit Notes
+## AI Guardrail And Credit Notes
 
 - AI generation in `apps/api` should go through `src/lib/aiService.ts` so prompt guardrails and credit enforcement are applied.
 - Prompt-policy and size controls are centralized in `src/lib/aiInputGuardrails.ts`.
@@ -48,9 +50,41 @@ This repo is a monorepo with multiple deployable apps. Treat each app as a separ
 - Keep credit/billing implementation separate from public positioning; do not hide billing logic by renaming data fields.
 - Lead status labels should match supported application statuses unless a display-only mapping is clearly safe.
 
-# AI Agent Scope Rules for Positioning and UI Copy Changes
+## Documentation Sync Rules
+
+When the repo is reassessed, or when runtime boundaries change, update these together:
+
+1. `README.md`
+2. `MASTER_SYSTEM_ARCHITECTURE.md`
+3. `docs/ARCHITECTURE.md`
+4. `docs/README.md`
+5. `docs/context/ARCHITECTURE.md`
+6. `docs/context/LAUNCH_READINESS.md`
+7. the latest readiness assessment document in `docs/`
+
+If an older doc reflects a prior architecture, either update it or clearly mark it as historical/planning-only.
+
+## Repo-Wide Reassessment Workflow
+
+For "reassess the entire app" requests:
+
+1. confirm deployable services and shared packages
+2. verify at least one readiness/runtime command per critical service
+3. check whether the current docs match the actual repo shape
+4. separate API readiness from overall launch readiness
+5. call out blockers with evidence, not optimism
+
+Minimum useful commands:
+
+- `npm run readiness:audit --workspace apps/api`
+- `npm run lint --workspace apps/web`
+- `npm run test:coverage --workspace apps/web`
+- `npm run test:e2e --workspace apps/web -- e2e/auth.spec.ts e2e/dashboard.spec.ts`
+
+# AI Agent Scope Rules For Positioning And UI Copy Changes
 
 For copy, positioning, or UI messaging tasks:
+
 - Use minimum context.
 - Search targeted files only.
 - Prefer small patches over broad rewrites.
@@ -62,9 +96,10 @@ For copy, positioning, or UI messaging tasks:
 - Before editing, identify the smallest set of files needed.
 - After editing, report only files changed and concise summaries.
 
-## Token Budget Rules for AI Agents
+## Token Budget Rules For AI Agents
 
 For positioning, copy, UX, and UI-label tasks:
+
 - Use minimum context.
 - Do not scan the full repository.
 - Inspect only the smallest likely set of files.
@@ -77,24 +112,24 @@ For positioning, copy, UX, and UI-label tasks:
 - Do not use subagents or parallel agents unless explicitly requested.
 - Before editing, list the exact files to inspect.
 - After editing, report only files changed and concise summaries.
-Most important rule
 
-Use Antigravity like this:
+Most important rule:
 
-Find files → stop.
-Patch one surface → stop.
-Verify banned phrases → stop.
+Use Antigravity like this:
 
-Do not ask:
+Find files -> stop.  
+Patch one surface -> stop.  
+Verify banned phrases -> stop.
 
-Analyze the full app and implement the architecture changes.
+Do not ask for a full-app analysis and architecture rewrite unless the user explicitly asked for that breadth.
 
 ## Multi-Agent Review Workflow
 
-Project Goal:
+Project goal:
 Review and improve this application for security, customer experience, usability, reliability, and performance.
 
 Rules for all review agents:
+
 - Do not make assumptions without checking the code.
 - Do not change business logic unless clearly required.
 - Every issue must include file name, problem, impact, suggested fix, and priority: Critical / High / Medium / Low.
@@ -105,11 +140,13 @@ Rules for all review agents:
 - Do not allow agents to overwrite each other's work; use separate branches, workspaces, or read-only report outputs when possible.
 
 Recommended initial review agents:
+
 - Builder Agent: app structure, main flows, broken or incomplete areas, obvious bugs, and proposed files to modify before editing.
 - Security Review Agent: authentication, authorization, exposed routes, input validation, injection risks, XSS, CSRF, uploads, secrets, env misuse, admin routes, rate limits, and data leakage.
 - Customer Experience and Usability Agent: first-time customer journey, homepage clarity, value proposition, CTAs, forms, messaging, mobile flow, navigation, accessibility basics, loading, empty, and error states.
 - QA Agent: smoke, functional, validation, mobile, security-related, negative, and edge-case test plan, plus missing tests and critical automation gaps.
 
 Consolidation model:
+
 - Product Manager Agent removes duplicates, prioritizes by business impact, and divides work into Must fix before launch, Should fix soon, and Good to have.
 - Developer-ready tasks should include owner: Codex Builder, Security, UX, QA, or Performance.