feat: service layering and platform hardening

.env.example

@@ -0,0 +1,65 @@
+# SpecCursor environment template
+# Copy to .env (local), .env.staging, or .env.production — never commit real secrets.
+#
+# APP_ENV selects the deploy profile used by fail-closed secret checks:
+#   development | staging | production
+# NODE_ENV remains Node semantics (development | test | production).
+
+APP_ENV=development
+NODE_ENV=development
+LOG_LEVEL=info
+
+# --- Ports (local process defaults; compose overrides per service) ---
+# controller: 3001, ai-service: 3002, github-app: 3000
+PORT=3000
+
+# --- Postgres ---
+# Local docker-compose default (development only). Staging/production MUST NOT
+# use the speccursor_dev password — startup asserts reject it.
+DATABASE_URL=postgresql://speccursor:speccursor_dev@localhost:5432/speccursor
+# DB_HOST=localhost
+# DB_PORT=5432
+# DB_NAME=speccursor
+# DB_USER=speccursor
+# DB_PASSWORD=
+# DB_SSL=true
+# DB_SSL_REJECT_UNAUTHORIZED=true
+
+# --- Redis ---
+REDIS_URL=redis://localhost:6379
+# REDIS_HOST=localhost
+# REDIS_PORT=6379
+# REDIS_PASSWORD=
+
+# --- Anthropic / Claude (ai-service, scripts/ai-patch.ts) ---
+# Required in staging/production. Local: empty boots, requests fail closed.
+ANTHROPIC_API_KEY=
+# Deprecated alias (still accepted if ANTHROPIC_API_KEY unset):
+# CLAUDE_API_KEY=
+CLAUDE_MODEL=claude-sonnet-4-20250514
+CLAUDE_MAX_TOKENS=4096
+CLAUDE_TEMPERATURE=0.1
+CLAUDE_TIMEOUT=30000
+
+# --- GitHub App (github-app) ---
+# Required in staging/production. Local webhook verification still needs
+# GITHUB_WEBHOOK_SECRET; Octokit calls fail closed without app credentials.
+GITHUB_APP_ID=
+GITHUB_PRIVATE_KEY=
+GITHUB_WEBHOOK_SECRET=
+# Legacy alias for webhook secret (prefer GITHUB_WEBHOOK_SECRET):
+# WEBHOOK_SECRET=
+
+# --- Auth ---
+# Required for github-app in staging/production. Never use your-secret-key.
+JWT_SECRET=
+
+# --- Optional observability ---
+# METRICS_ENABLED=true
+# TRACING_ENABLED=true
+# JAEGER_ENDPOINT=http://localhost:14268/api/traces
+# ALLOWED_ORIGINS=https://example.com
+
+# --- CI-only (GitHub Actions repository secrets; not used by local compose) ---
+# SNYK_TOKEN=          # optional; qualify.yml skips Snyk when unset
+# CODECOV_TOKEN=       # unused by primary CI

.env.production.example

@@ -0,0 +1,23 @@
+# Production secrets — copy to .env.production and fill real values. Never commit .env.production.
+
+APP_ENV=production
+NODE_ENV=production
+LOG_LEVEL=warn
+IMAGE_TAG=prod
+
+POSTGRES_USER=speccursor
+POSTGRES_DB=speccursor
+POSTGRES_PASSWORD=
+REDIS_PASSWORD=
+
+ANTHROPIC_API_KEY=
+
+GITHUB_APP_ID=
+GITHUB_PRIVATE_KEY=
+GITHUB_WEBHOOK_SECRET=
+JWT_SECRET=
+
+CONTROLLER_PORT=3001
+AI_SERVICE_PORT=3002
+GITHUB_APP_PORT=3080
+DB_SSL=false

.env.staging.example

@@ -0,0 +1,27 @@
+# Staging secrets — copy to .env.staging and fill real values. Never commit .env.staging.
+
+APP_ENV=staging
+NODE_ENV=production
+LOG_LEVEL=info
+IMAGE_TAG=staging
+
+# Infra (compose injects DATABASE_URL / REDIS_URL into app containers)
+POSTGRES_USER=speccursor
+POSTGRES_DB=speccursor
+POSTGRES_PASSWORD=
+REDIS_PASSWORD=
+
+# Anthropic
+ANTHROPIC_API_KEY=
+
+# GitHub App
+GITHUB_APP_ID=
+GITHUB_PRIVATE_KEY=
+GITHUB_WEBHOOK_SECRET=
+JWT_SECRET=
+
+# Optional publish ports
+CONTROLLER_PORT=3001
+AI_SERVICE_PORT=3002
+GITHUB_APP_PORT=3080
+DB_SSL=false

.eslintrc.js

@@ -6,128 +6,39 @@ module.exports = {
   },
   extends: [
     'eslint:recommended',
-    '@typescript-eslint/recommended',
-    '@typescript-eslint/recommended-requiring-type-checking',
-    'plugin:import/recommended',
-    'plugin:import/typescript',
-    'plugin:node/recommended',
+    'plugin:@typescript-eslint/recommended',
     'prettier',
   ],
   parser: '@typescript-eslint/parser',
   parserOptions: {
     ecmaVersion: 2022,
     sourceType: 'module',
-    project: [
-      './tsconfig.json',
-      './apps/*/tsconfig.json',
-      './packages/*/tsconfig.json',
-    ],
-    tsconfigRootDir: __dirname,
   },
-  plugins: ['@typescript-eslint', 'import', 'node'],
+  plugins: ['@typescript-eslint'],
   rules: {
-    // TypeScript specific rules
     '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-    '@typescript-eslint/explicit-function-return-type': 'warn',
-    '@typescript-eslint/no-explicit-any': 'warn',
-    '@typescript-eslint/prefer-const': 'error',
-    '@typescript-eslint/no-var-requires': 'error',
-    '@typescript-eslint/consistent-type-imports': 'error',
-
-    // Import rules
-    'import/order': [
-      'error',
-      {
-        groups: [
-          'builtin',
-          'external',
-          'internal',
-          'parent',
-          'sibling',
-          'index',
-        ],
-        'newlines-between': 'always',
-        alphabetize: {
-          order: 'asc',
-          caseInsensitive: true,
-        },
-      },
-    ],
-    'import/no-unresolved': 'error',
-    'import/no-cycle': 'error',
-
-    // Node.js rules
-    'node/no-unsupported-features/es-syntax': 'off',
-    'node/no-missing-import': 'off',
-
-    // General rules
-    'no-console': 'warn',
+    '@typescript-eslint/explicit-function-return-type': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-var-requires': 'off',
+    '@typescript-eslint/consistent-type-imports': 'off',
+    '@typescript-eslint/ban-ts-comment': 'off',
+    '@typescript-eslint/no-empty-function': 'off',
+    '@typescript-eslint/no-require-imports': 'off',
+    'no-console': 'off',
     'no-debugger': 'error',
     'prefer-const': 'error',
     'no-var': 'error',
-    'object-shorthand': 'error',
-    'prefer-template': 'error',
-  },
-  settings: {
-    'import/resolver': {
-      typescript: {
-        alwaysTryTypes: true,
-        project: './tsconfig.json',
-      },
-    },
   },
   overrides: [
     {
-      files: ['**/*.test.ts', '**/*.spec.ts'],
-      env: {
-        jest: true,
-      },
-      rules: {
-        '@typescript-eslint/no-explicit-any': 'off',
-        'no-console': 'off',
-      },
-    },
-    {
-      files: ['**/scripts/**/*.ts'],
-      rules: {
-        'no-console': 'off',
-      },
+      files: ['**/*.test.ts', '**/*.spec.ts', '**/__tests__/**/*.ts'],
+      env: { jest: true },
     },
     {
       files: ['*.js', '**/*.config.js', '*rc.js', '**/*rc.js'],
-      env: {
-        node: true,
-        commonjs: true,
-      },
-      parserOptions: {
-        ecmaVersion: 2022,
-        sourceType: 'script',
-      },
-      rules: {
-        '@typescript-eslint/no-var-requires': 'off',
-        'no-undef': 'off',
-      },
-    },
-    {
-      files: ['load/**/*.js'],
-      env: {
-        es6: true,
-      },
-      parserOptions: {
-        ecmaVersion: 2022,
-        sourceType: 'module',
-      },
-      globals: {
-        __ENV: 'readonly',
-        __VU: 'readonly',
-        console: 'readonly',
-        textSummary: 'readonly',
-      },
-      rules: {
-        'no-console': 'off',
-        'no-undef': 'off',
-        '@typescript-eslint/no-var-requires': 'off',
-      },
+      env: { node: true, commonjs: true },
+      parserOptions: { ecmaVersion: 2022, sourceType: 'script' },
+      rules: { 'no-undef': 'off' },
     },
   ],
 };

.github/dependabot.yml

@@ -0,0 +1,33 @@
+# Dependabot — weekly dependency and Actions updates
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    groups:
+      production-deps:
+        dependency-type: production
+      dev-deps:
+        dependency-type: development
+
+  - package-ecosystem: cargo
+    directory: /workers/rust-worker
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+    # Only when Dockerfiles exist at scanned paths