feat(ai): site-knowledge index for retrieval evals (group 1)

.cplt.toml

@@ -0,0 +1,22 @@
+# Generated by `cplt init`. Review before trusting.
+# Detected: Node.js, Docker, Python, Playwright, Vite
+# Workspace members:
+#   frontend-typescript (heuristic scan): Node.js, Docker, Playwright, Vite
+
+[propose]
+# Suggested by: frontend-typescript
+allow_localhost_any = true
+# Repo tracks .env.* files in every service; sandbox needs to read/write them
+# for git add/commit/stash to work. See CLAUDE.md env-file handling note.
+allow_env_files = true
+
+[propose.allow]
+localhost = [80, 443, 4000, 4317, 4318, 5173, 5432, 5433, 5555, 5672, 5673, 6379, 6380, 8000, 8082, 8889, 9000, 9001, 9002, 9003, 9010, 9011, 9020, 9021, 9082, 9090, 9411, 15672, 15673, 15692]
+
+## Machine-specific — these belong in ~/.config/cplt/config.toml, not here.
+## Copy the [section] headers too: keys pasted at the end of that file are
+## scoped by whichever header precedes them, which silently drops the grant.
+#
+# [sandbox]
+# allow_cache_exec = ["ms-playwright"]
+

.github/workflows/ai.yml

@@ -24,13 +24,31 @@ jobs:
             relevant:
               - "services/ai/**"
               - "shared/**"
+              - "frontend-typescript/src/content/site/**"
+              - "docs/user-guide/**"
+              - "docs/PRODUCT.md"
 
   ai-test:
     needs: changes
     if: needs.changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: grandflow_ai
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     env:
       AI_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/grandflow_ai
+      AI_TEST_POSTGRES_URL: postgresql://postgres:postgres@localhost:5432/grandflow_ai
       LOG_LEVEL: INFO
       PYTHONPATH: ${{ github.workspace }}/services/ai:${{ github.workspace }}
       AI_PROVIDER_APPROVED_ORIGINS: '[{"origin": "http://ollama:11434", "allow_private": true}]'

.github/workflows/frontend.yml

@@ -40,6 +40,10 @@ jobs:
         working-directory: ./frontend-typescript
         run: npm ci
 
+      - name: Lint (baseline ratchet)
+        working-directory: ./frontend-typescript
+        run: npm run lint:ci
+
       - name: Run Vitest
         working-directory: ./frontend-typescript
         run: npx vitest run --coverage

.github/workflows/reindex-content.yml

@@ -0,0 +1,33 @@
+name: Reindex Site Content
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "frontend-typescript/src/content/site/**"
+      - "docs/user-guide/**"
+      - "docs/PRODUCT.md"
+
+permissions: {}
+
+jobs:
+  reindex:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reindex content and restart AI service
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          command_timeout: 5m
+          script: |
+            set -euo pipefail
+            cd /opt/grandflow
+
+            # Fetch latest main and update checkout
+            git fetch origin main
+            git reset --hard origin/main
+
+            # Restart ai container to trigger startup ingestion hook
+            docker compose --env-file .env.prod -f docker-compose.prod.yml restart ai

CLAUDE.md

@@ -67,3 +67,17 @@ This is enforced, not just documented: `.claude/hooks/check_comment_brevity.py`
 (a `PreToolUse` hook on `Write`/`Edit`) denies any write that introduces a
 comment longer than that, so trim it before retrying rather than fighting the
 hook.
+
+## Frontend lint — fix on touch, never add to the pile
+
+`frontend-typescript` has a pre-existing lint backlog. Rather than block on
+fixing it all at once, CI enforces a ratchet: `BASELINE` in
+`frontend-typescript/scripts/check-lint-baseline.mjs` caps total ESLint
+problems, checked by `npm run lint:ci`. A push that adds new lint errors
+fails; one that fixes some should lower `BASELINE` to lock the win in. When
+you touch a file that already has lint issues, fix them as part of that
+change instead of leaving them for later.
+
+This is enforced, not just documented: `.github/workflows/frontend.yml` runs
+`lint:ci` on every push/PR touching `frontend-typescript/**`, and
+`scripts/git-hooks/pre-push` mirrors it locally (see WORKFLOW.md §8).

docker-compose.local.yml

@@ -140,6 +140,9 @@ services:
     volumes:
       - ./shared:/app/shared:ro
       - ./services/ai:/app
+      - ./frontend-typescript/src/content/site:/app/content/site:ro
+      - ./docs/user-guide:/app/docs/user-guide:ro
+      - ./docs/PRODUCT.md:/app/docs/PRODUCT.md:ro
     env_file:
       - ./services/ai/.env.ai.private.local
     environment:

docker-compose.prod.yml

@@ -109,6 +109,11 @@ services:
       dockerfile: services/ai/Dockerfile
     container_name: ai-service
     restart: unless-stopped
+    # Bind-mounted so `restart ai` reindexes freshly pulled content without a rebuild.
+    volumes:
+      - ./frontend-typescript/src/content/site:/app/content/site:ro
+      - ./docs/user-guide:/app/docs/user-guide:ro
+      - ./docs/PRODUCT.md:/app/docs/PRODUCT.md:ro
     env_file:
       - ./services/ai/.env.ai.prod
     environment:

docs/development/WORKFLOW.md

@@ -161,8 +161,11 @@ rather than fast-forward-mergeable). Pass `--yes` to skip the prompt.
 (`black --check`, `mypy`, `flake8`) locally, scoped to whichever service(s) the
 push actually touches (a `shared/` change checks all four). A push touching
 `scripts/*.py` runs `black --check`, `flake8 --max-line-length=100` and
-`scripts/test_flow.py` over `scripts/` — the workflow tooling lints itself. The
-hook also rejects a branch whose name doesn't match §3. One-time setup:
+`scripts/test_flow.py` over `scripts/` — the workflow tooling lints itself. A
+push touching `frontend-typescript/*.{ts,tsx}` runs `npm run lint:ci`, the
+same ESLint baseline ratchet as `frontend.yml` (see CLAUDE.md's "Frontend
+lint" section). The hook also rejects a branch whose name doesn't match §3.
+One-time setup:
 
 ```
 git config core.hooksPath scripts/git-hooks

frontend-typescript/eslint.config.js

@@ -6,7 +6,7 @@ import tseslint from 'typescript-eslint'
 import { globalIgnores } from 'eslint/config'
 
 export default tseslint.config([
-  globalIgnores(['dist']),
+  globalIgnores(['dist', 'coverage']),
   {
     files: ['**/*.{ts,tsx}'],
     extends: [