0.6.0

.codex/hooks.json

@@ -0,0 +1,17 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.intent/hooks/intent-codex-gate.mjs\"",
+            "timeout": 60,
+            "statusMessage": "Loading Intent skill catalog"
+          }
+        ]
+      }
+    ]
+  }
+}

.github/workflows/backend-db-validate.yml

@@ -35,8 +35,8 @@ jobs:
       - name: Install dependencies (workspace)
         run: pnpm --filter @partner-up-dev/backend... install --frozen-lockfile
 
-      - name: Lint migration and seed files
-        run: pnpm --filter @partner-up-dev/backend db:lint
+      - name: Validate backend DB config and migration files
+        run: pnpm check:config:backend
 
       - name: Regenerate Drizzle SQL artifacts
         run: pnpm --filter @partner-up-dev/backend db:generate

.github/workflows/backend-fc-deploy.yml

@@ -75,6 +75,7 @@ jobs:
       ALIBABA_CLOUD_ACCOUNT_ID: ${{ secrets.ALIBABA_CLOUD_ACCOUNT_ID }}
       BACKEND_COMMIT_HASH: ${{ github.sha }}
       GITHUB_EVENT_BEFORE: ${{ github.event.before }}
+      PARTNERUP_ENVIRONMENT: ${{ github.ref == 'refs/heads/master' && 'production' || 'staging' }}
       PUBLISH_LAYER_ONLY: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_layer_only == true }}
     steps:
       - name: Checkout

.github/workflows/backend-gate.yml

@@ -13,6 +13,9 @@ on:
       - "pnpm-lock.yaml"
       - "pnpm-workspace.yaml"
       - ".node-version"
+      - "biome.json"
+      - "sgconfig.yml"
+      - "tools/**"
       - ".github/workflows/backend-gate.yml"
   workflow_dispatch:
 
@@ -58,13 +61,16 @@ jobs:
         run: pnpm --filter . --filter @partner-up-dev/backend... install --frozen-lockfile
 
       - name: Typecheck backend
-        run: pnpm --filter @partner-up-dev/backend typecheck
+        run: pnpm check:type:backend
+
+      - name: Validate backend config artifacts
+        run: pnpm check:config:backend
+
+      - name: Build backend reachability targets
+        run: pnpm check:build:backend
 
       - name: Run backend unit tests
         run: pnpm test:unit:backend
 
-      - name: Lint backend DB artifacts
-        run: pnpm db:lint
-
       - name: Run backend scenario tests
         run: pnpm test:scenario:backend

.github/workflows/frontend-gate.yml

@@ -14,6 +14,7 @@ on:
       - "pnpm-workspace.yaml"
       - ".node-version"
       - ".npmrc"
+      - "biome.json"
       - ".github/workflows/frontend-gate.yml"
   workflow_dispatch:
 
@@ -43,11 +44,11 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Lint frontend design tokens
-        run: pnpm --filter @partner-up-dev/frontend lint:tokens:strict
+      - name: Typecheck frontend
+        run: pnpm check:type:frontend
 
       - name: Run frontend unit tests
         run: pnpm test:unit:frontend
 
       - name: Build frontend
-        run: pnpm --filter @partner-up-dev/frontend build
+        run: pnpm check:build:frontend

.github/workflows/static-gate.yml

@@ -0,0 +1,74 @@
+name: Static Gate
+
+on:
+  pull_request:
+    branches:
+      - master
+      - develop
+    paths:
+      - ".github/workflows/static-gate.yml"
+      - ".node-version"
+      - ".npmrc"
+      - "AGENTS.md"
+      - "apps/**"
+      - "packages/**"
+      - "scripts/**"
+      - "tests/**"
+      - "tools/**"
+      - "biome.json"
+      - "knip.json"
+      - "sgconfig.yml"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "vitest.config.ts"
+      - "vitest.backend.config.ts"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  static-gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN || github.token }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: pnpm
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Semgrep
+        run: python -m pip install semgrep==1.166.0
+
+      - name: Check changed-file formatting
+        run: pnpm check:format
+
+      - name: Run static lint
+        run: pnpm check:lint
+
+      - name: Report dead code and dependency hygiene
+        run: pnpm check:dead-code
+
+      - name: Report security findings
+        run: pnpm check:security

.gitignore

@@ -115,3 +115,4 @@ __pycache__/
 # Special case
 tasks/frontend-screenshot-capture/**/*
 apps/backend/images/**/*
+apps/backend/.dev-server/