Generalize Markdown Task Manager as Research Workbench

.dockerignore

@@ -7,6 +7,11 @@ web/node_modules
 web/dist
 web/test-results
 vault
+.generated
+data
+dashboard
+private
+attachments
 .env
 .secrets
 .backups

.env.example

@@ -4,6 +4,9 @@ PM_APP_TOKEN=replace-with-a-long-random-value
 # Defaults to ./vault. An absolute directory is recommended for real data.
 PM_VAULT_ROOT=
 
+# Defaults to <vault>/.generated.
+PM_OUTPUT_ROOT=
+
 # Comma-separated browser origins allowed to call the API.
 PM_CORS_ORIGINS=
 
@@ -12,5 +15,5 @@ PM_GITHUB_SYNC_ENABLED=false
 PM_GITHUB_REPO=your-account/your-private-vault
 PM_GITHUB_BRANCH=main
 PM_GITHUB_TOKEN=
-PM_GITHUB_AUTHOR_NAME=Markdown Task Manager
-PM_GITHUB_AUTHOR_EMAIL=task-manager@example.invalid
+PM_GITHUB_AUTHOR_NAME=Research Workbench Automation
+PM_GITHUB_AUTHOR_EMAIL=workbench-automation@example.invalid

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,52 @@
+name: Bug report
+description: Report a reproducible problem using synthetic data.
+title: "[Bug] "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not paste private vault content, credentials, local paths, or screenshots containing real data.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Release tag or commit SHA.
+    validations:
+      required: true
+  - type: dropdown
+    id: install
+    attributes:
+      label: Installation
+      options:
+        - Local Python and Node
+        - Docker Compose
+        - Other private deployment
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Synthetic reproduction
+      description: Provide the smallest reproduction using example-vault or fabricated content.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check
+      options:
+        - label: I removed private content, credentials, identifying paths, and real personal data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private vulnerability report
+    url: https://github.com/sfuchs-de/markdown-task-manager/security/advisories/new
+    about: Report security problems privately; never post secrets or vault excerpts.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a generic, privacy-safe improvement.
+title: "[Feature] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What generic workflow is difficult today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: vault
+    attributes:
+      label: Vault or schema impact
+      description: Describe new fields, migrations, or compatibility concerns.
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Privacy and security impact
+      description: Explain whether this changes data exposure, authentication, or exports.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+Describe the user-visible change and its motivation.
+
+## Verification
+
+- [ ] `make test`
+- [ ] `make build`
+- [ ] `make privacy`
+- [ ] `make links`
+- [ ] Relevant local or Docker smoke test
+
+## Privacy and compatibility
+
+- [ ] Tests, screenshots, and examples contain only fictional data.
+- [ ] No credentials, private URLs, identifying paths, binary documents, or vault output were added.
+- [ ] Vault/frontmatter changes are backward compatible or have an upgrade note.
+- [ ] `private: true` is treated as a display filter, not encryption.

.github/workflows/ci.yml

@@ -16,16 +16,27 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
           cache: pip
       - run: python -m pip install -r requirements-dev.txt
       - run: python -m pytest
-      - run: python scripts/privacy_scan.py
+      - name: Validate a pinned synthetic vault
+        run: |
+          vault="$(mktemp -d)"
+          python scripts/pm.py init --vault "$vault" --today 2026-07-30
+          PM_VAULT_ROOT="$vault" PM_OUTPUT_ROOT="$vault/.generated" python scripts/pm.py doctor
+          python scripts/validate_vault_schema.py --root "$vault"
+          PM_VAULT_ROOT="$vault" PM_OUTPUT_ROOT="$vault/.generated" python scripts/sync_markdown.py
+          PM_VAULT_ROOT="$vault" PM_OUTPUT_ROOT="$vault/.generated" PM_RENDER_TIMESTAMP=2026-07-30T12:00:00Z python scripts/render_static.py
+      - run: python scripts/check_links.py
+      - run: python scripts/privacy_scan.py --all-files --history
       - run: python -m pip install pip-audit && python -m pip_audit -r requirements-dev.txt
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm
@@ -34,11 +45,13 @@ jobs:
       - run: npm --prefix web audit --audit-level=moderate
       - run: npm --prefix web test
       - run: npm --prefix web run build
-      - run: npm --prefix web exec -- playwright install --with-deps chromium webkit
+      - run: cd web && npx playwright install --with-deps chromium
       - run: npm --prefix web run test:e2e
+      - run: git diff --check
 
   container:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - run: docker build --tag markdown-task-manager:test .
+      - uses: actions/checkout@v6
+      - run: docker build --tag research-workbench:test .
+      - run: python scripts/docker_smoke.py --image research-workbench:test

.gitignore

@@ -14,6 +14,9 @@ web/vite.config.js
 web/vite.config.d.ts
 web/vitest.config.js
 web/vitest.config.d.ts
+.generated/
+data/
+dashboard/
 
 # User vaults are intentionally outside the public source history.
 vault/*
@@ -22,6 +25,19 @@ vault/*
 # Local exports and credentials.
 .secrets/
 .backups/
+private/
+attachments/
 exports/
 *.sqlite
 *.db
+*.pdf
+*.doc
+*.docx
+*.xls
+*.xlsx
+*.ppt
+*.pptx
+*.dta
+*.parquet
+*.feather
+*.rds

CHANGELOG.md

@@ -1,11 +1,17 @@
 # Changelog
 
-## 1.0.0
+## 1.1.0
 
-- Initial public, privacy-reviewed edition.
-- Markdown projects, tasks, notes, and calendar metadata.
+- Initial Research Workbench release.
+- Configurable projects, tasks, notes, calendar, boards, graph, and time planning.
+- Metadata-driven admin, travel, collaborator, wellness, performance, and
+  scholar-metrics modules.
 - Search, reading, editing, task-status controls, wiki links, and backlinks.
 - Responsive light/dark web interface.
-- Local, Docker, and Render setup.
+- Local and Docker/private self-hosting setup.
 - Optional private GitHub vault synchronization.
 - Synthetic example vault and automated privacy scanning.
+
+The repository already contained a `v1.0.0` public release before the
+Research Workbench generalization, so the first generalized release is
+numbered `v1.1.0`.

Dockerfile

@@ -8,12 +8,15 @@ RUN npm --prefix web run build
 FROM python:3.11-slim
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
-    PM_VAULT_ROOT=/vault
+    PM_VAULT_ROOT=/vault \
+    PM_OUTPUT_ROOT=/vault/.generated
 WORKDIR /app
 COPY requirements.txt .
 RUN python -m pip install --no-cache-dir -r requirements.txt
 COPY server ./server
 COPY scripts ./scripts
+COPY templates ./templates
+COPY example-vault ./example-vault
 COPY --from=web /app/web/dist ./web/dist
 RUN mkdir -p /vault && useradd --create-home --uid 10001 app && chown -R app:app /app /vault
 USER app

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Markdown Task Manager contributors
+Copyright (c) 2026 Simon Fuchs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -1,4 +1,4 @@
-.PHONY: setup demo dev api web test build privacy docker
+.PHONY: setup init dev api web test test-empty test-e2e build doctor privacy links qa docker
 
 PYTHON ?= python3
 
@@ -7,8 +7,13 @@ setup:
 	.venv/bin/python -m pip install -r requirements-dev.txt
 	npm --prefix web ci
 
-demo:
-	.venv/bin/python scripts/bootstrap_demo.py
+init:
+	.venv/bin/python scripts/pm.py init --vault vault
+
+demo: init
+
+dev:
+	@echo "Run 'make api' and 'make web' in separate terminals."
 
 api:
 	PM_VAULT_ROOT="$${PM_VAULT_ROOT:-$$(pwd)/vault}" .venv/bin/python -m uvicorn server.app:app --host 127.0.0.1 --port 8765 --reload
@@ -20,14 +25,25 @@ test:
 	.venv/bin/python -m pytest
 	npm --prefix web run test
 
+test-empty:
+	@tmp=$$(mktemp -d); PM_VAULT_ROOT="$$tmp" .venv/bin/python -m pytest; rm -rf "$$tmp"
+
 test-e2e:
 	npm --prefix web run test:e2e
 
 build:
 	npm --prefix web run build
 
+doctor:
+	.venv/bin/python scripts/pm.py doctor
+
 privacy:
 	.venv/bin/python scripts/privacy_scan.py --all-files
 
+links:
+	.venv/bin/python scripts/check_links.py
+
+qa: test build privacy links
+
 docker:
 	docker compose up --build