Promote dev to main

.dockerignore

@@ -0,0 +1,25 @@
+.git
+**/.venv
+**/__pycache__
+**/*.pyc
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+**/*.egg-info
+apps/backend/.local
+apps/backend/local
+apps/backend/tests
+apps/backend/coverage
+apps/backend/htmlcov
+apps/backend/.coverage
+**/.env
+**/.env.*
+!**/.env.example
+node_modules
+apps/frontend/node_modules
+apps/frontend/dist
+apps/frontend/coverage
+apps/frontend/test-results
+apps/frontend/e2e-report
+.DS_Store
+.claude

.env.example

@@ -7,9 +7,14 @@ REDIS_URL=redis://localhost:6379/0
 STORAGE_PATH=./apps/backend/.local/storage
 CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
 AUTO_CREATE_TABLES=true
+ANALYSIS_MAX_REPOSITORY_SOURCE_BYTES=1073741824
+ANALYSIS_MAX_PROCESS_RSS_BYTES=2147483648
+ANALYSIS_MAX_DURATION_SECONDS=1800
 
-# Docker Compose PostgreSQL defaults. Compose consumes these values; the local
-# backend .env example uses SQLite so direct local startup works without services.
-POSTGRES_USER=partha
-POSTGRES_PASSWORD=partha
-POSTGRES_DB=partha
+# AI provider outbound egress policy. Hosted is the safe default: built-in
+# cloud providers keep their fixed HTTPS origins and no tenant-configurable
+# endpoint is enabled. To use a local/internal Ollama endpoint, explicitly set
+# self_hosted and provide both exact administrator-owned allowlists below.
+AI_EGRESS_MODE=hosted
+AI_EGRESS_ALLOWED_BASE_URLS=
+AI_EGRESS_ALLOWED_CIDRS=

.gitattributes

@@ -0,0 +1,33 @@
+# PARTHA .gitattributes
+# Normalise line endings and keep binary assets safe across platforms.
+# Generated lockfiles (package-lock.json) are large but text; Git/Linguist
+# already treats them as generated, so we keep them as text for sane diffs.
+
+# Default: normalise to LF on commit, convert to native on checkout.
+* text=auto eol=lf
+
+# Lockfiles and dependency manifests are text (large diffs, not binary).
+*.lock text
+package-lock.json text
+pnpm-lock.yaml text
+requirements*.txt text
+
+# Hand-authored SVG stays text (editable in-repo).
+*.svg text
+
+# Binary assets must never be line-ending-converted.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.eot binary
+*.zip binary
+*.gz binary
+*.tar binary
+*.pdf binary

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @parthrohit22

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -3,6 +3,12 @@ description: Report broken or incorrect behavior in PARTHA.
 title: "bug: "
 labels: [bug]
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not report security vulnerabilities here. Public issues are the wrong
+        channel — disclose them privately as described in
+        [SECURITY.md](https://github.com/Second-Origin/PARTHA/blob/dev/SECURITY.md).
   - type: textarea
     id: summary
     attributes:
@@ -50,9 +56,9 @@ body:
     id: evidence
     attributes:
       label: Evidence
-      description: Logs, screenshots, response payloads, or audit references.
+      description: Logs, screenshots, or response payloads. Do not include secrets, credentials, or private repository contents.
   - type: textarea
     id: environment
     attributes:
       label: Environment
-      description: Browser, OS, Node/Python versions, Docker availability, branch/commit.
+      description: Browser, OS, Node/Python versions, and branch/commit.

.github/ISSUE_TEMPLATE/engineering_task.yml

@@ -1,5 +1,5 @@
 name: Engineering Task
-description: Track technical debt, refactors, tests, infrastructure, or audit backlog work.
+description: Track technical debt, refactors, tests, or infrastructure work.
 title: "chore: "
 labels: [engineering]
 body:
@@ -21,7 +21,7 @@ body:
     id: references
     attributes:
       label: References
-      description: Link audit rows, files, logs, or related issues.
+      description: Link files, logs, or related issues.
   - type: textarea
     id: implementation
     attributes:

.github/dependabot.yml

@@ -0,0 +1,139 @@
+# Dependabot configuration for the PARTHA monorepo.
+#
+# Part of the dependency, secret, and code scanning baseline. Branch protection
+# is already enabled on dev/main; Dependabot doesn't produce a status check of
+# its own to require -- the PRs it opens go through the normal CI gate (ci.yml)
+# like any other PR.
+#
+# Two ecosystems, one per app: npm for the React/TS frontend, pip for the
+# FastAPI backend.
+#
+# Grouping policy
+# ---------------
+# The default "one PR per package" behaviour produces PRs that cannot go green,
+# because several of our dependencies are only installable in lockstep:
+#
+#   * `pydantic` pins `pydantic-core` exactly. Bumping the core alone yields
+#     `ResolutionImpossible` at `pip install`, before a single test runs.
+#   * `react` and `react-dom` must move together, and both are peer dependencies
+#     of `@testing-library/react` and `@xyflow/react`. Bumping either alone
+#     yields an ERESOLVE failure at `npm ci`.
+#
+# Those PRs are not review load, they are noise: no reviewer action can make
+# them pass. The groups below force each cohort into a single PR so the
+# resolver has a consistent set to work with, and the lockstep majors are
+# ignored outright so they are raised as deliberate migration work instead of
+# an unmergeable weekly bump.
+version: 2
+
+updates:
+  # ---------------------------------------------------------------------------
+  # Frontend — npm (apps/frontend)
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: npm
+    directory: /apps/frontend
+    # `dev` is the real trunk and is now the repository default branch, so both
+    # version updates and security updates land here. CONTRIBUTING.md requires
+    # all PRs to target `dev`.
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    commit-message:
+      # Produces `chore(deps): ...` — Conventional Commits, per CONTRIBUTING.md.
+      prefix: chore
+      include: scope
+    groups:
+      # React and everything that peer-depends on it. Keeping these in one PR is
+      # what makes a React major reviewable at all: split across PRs, each half
+      # fails `npm ci` and none of them can be merged first.
+      react-ecosystem:
+        patterns:
+          - react
+          - react-dom
+          - "@types/react"
+          - "@types/react-dom"
+          - "@testing-library/react"
+        update-types:
+          - minor
+          - patch
+      frontend-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # React 19 is a coordinated migration, not a dependency bump: it moves
+      # react + react-dom + both `@types` packages and requires a
+      # v19-compatible `@testing-library/react`, with `@xyflow/react`,
+      # `framer-motion` and `react-dropzone` all re-verified. Dependabot raised
+      # it as two independent PRs (#249, #203); neither could install, so both
+      # sat red for twelve days. Track it as an issue and drop this ignore when
+      # the migration is scheduled.
+      - dependency-name: react
+        update-types: ["version-update:semver-major"]
+      - dependency-name: react-dom
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react-dom"
+        update-types: ["version-update:semver-major"]
+      # lucide-react v1 removed every brand icon, including `Github`, which
+      # PARTHA imports in four components. The bump therefore requires an icon
+      # migration in the same change and cannot be applied mechanically (#250).
+      - dependency-name: lucide-react
+        update-types: ["version-update:semver-major"]
+
+  # ---------------------------------------------------------------------------
+  # Backend — pip (apps/backend)
+  # ---------------------------------------------------------------------------
+  - package-ecosystem: pip
+    directory: /apps/backend
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      # `pydantic` pins `pydantic-core` to an exact version, so the two must
+      # appear in the same PR or the group is uninstallable. This is what broke
+      # #266: `pydantic-core` moved to 2.47.0 while `pydantic` stayed at 2.13.4,
+      # which requires `pydantic-core==2.46.4`.
+      pydantic-stack:
+        patterns:
+          - pydantic
+          - pydantic-core
+          - pydantic_core
+          - pydantic-settings
+        update-types:
+          - minor
+          - patch
+      backend-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # `pydantic-core` is not a direct dependency: pyproject.toml declares
+      # `pydantic`, and requirements.txt is `pip freeze` output, so the core
+      # only appears there as a resolved transitive pin. `pydantic` pins it to
+      # an exact version, so it has no independent upgrade path — the correct
+      # version is always whatever the installed `pydantic` asks for.
+      #
+      # Grouping alone does not stop this. A group only forms when one of its
+      # members actually has an update; with `pydantic` already at the latest
+      # release, a lone `pydantic-core` bump falls through to the catch-all
+      # `backend-minor-and-patch` group and breaks the build exactly as before
+      # (#266, then #277 again after the groups landed). Ignoring it outright
+      # is the only thing that holds: it now moves only when `pydantic` moves
+      # and drags it along.
+      - dependency-name: pydantic-core
+      - dependency-name: pydantic_core

.github/pull_request_template.md

@@ -1,38 +1,75 @@
 ## Summary
 
-- 
+<!-- What does this PR do, and why? -->
 
-## Type
+## Linked issue
 
-- [ ] Bug fix
-- [ ] Feature
-- [ ] Engineering task
-- [ ] Documentation
-- [ ] Security
+<!-- Use "Closes #123" ONLY if this PR fully satisfies every acceptance criterion.
+     Otherwise use "Related to #123", "Part of #123", or "Follow-up to #123". -->
 
-## Verification
+Closes #
 
-- [ ] Frontend build/lint run where relevant
-- [ ] Backend tests run where relevant
-- [ ] Docker Compose config/runtime readiness checked where relevant
-- [ ] Release/deployment docs updated where relevant
-- [ ] Manual verification described below
+## Scope
 
-Commands/results:
+<!-- MERGE GATE. Every PR must advance a tracked GitHub issue or an accepted
+     RFC, with accepted evidence. If this PR does not trace to either, it is
+     out of scope and should not be merged. Breadth additions (new surfaces,
+     new languages) that do not deepen the existing moat need explicit owner
+     justification in "Scope changes". -->
+
+- Issue or RFC this advances:
+- Why this is in scope (not a "quick useful surface" or breadth addition):
+- Accepted evidence it is real (test/usage/repo state, not intent):
+
+## What changed
+
+<!-- The main changes, by area (backend, frontend, docs, infra). -->
+
+## Acceptance criteria completed
+
+<!-- List each acceptance criterion from the issue and whether it is complete.
+     If one was dropped or changed, say so here — not only in a review comment. -->
+
+## Testing performed
+
+<!-- Exact commands run and their results. Do not claim a check you did not run.
+     If you could not run something locally, say so and explain why. -->
 
 ```text
 
 ```
 
-## Risk and Rollback
+## Screenshots
+
+<!-- Required for any visible UI change. Write "Not applicable" if there is none. -->
+
+## Security and data considerations
+
+<!-- Auth, owner scoping, secrets, logging, untrusted input, migrations, data loss.
+     Write "None" if genuinely none. Never include an exploit or proof of concept —
+     report vulnerabilities privately via SECURITY.md. -->
+
+## Dependencies and blocked work
+
+<!-- "Depends on #<pr-number>" for stacked work, plus the required merge order.
+     Link any follow-up issues or PRs. Write "None" if none. -->
+
+## Scope changes or remaining work
 
-- Risk level: Low / Medium / High
-- Rollback plan:
+<!-- Anything deferred, descoped, or discovered mid-implementation. Write "None" if none. -->
 
-## Checklist
+## Contributor checklist
 
-- [ ] No unrelated behavior changes
-- [ ] No secrets, local env files, generated build artifacts, or local databases committed
-- [ ] API behavior documented if changed
-- [ ] UI states covered for loading, empty, error, and success where relevant
-- [ ] Security/privacy impact considered
+- [ ] This PR targets `dev`
+- [ ] I claimed the issue and had it assigned or acknowledged before starting substantial work
+- [ ] The branch was created from an up-to-date `upstream/dev`
+- [ ] The branch is rebased on the latest `upstream/dev`
+- [ ] This PR addresses one clearly scoped issue
+- [ ] This PR is in scope: it advances a tracked issue or an accepted RFC (Scope section filled)
+- [ ] Every acceptance criterion I claim as complete is actually complete
+- [ ] Relevant tests pass
+- [ ] Documentation is updated for any user-visible change
+- [ ] No secrets, credentials, local env files, or generated artifacts are included
+- [ ] No unrelated files were changed
+- [ ] Closing syntax (`Closes`) is used only because the issue is fully resolved
+- [ ] Dependencies and follow-up work are linked