Phase 1+2: Foundation & Security Tests

.codecov.yml

@@ -0,0 +1,29 @@
+coverage:
+  status:
+    # Project-level gating is OFF until overall coverage > 30% (per AGENTS.md).
+    # At 1.17% baseline, target: auto would block every PR.
+    project: off
+    # Patch-level: warn-only. New code should be tested but not block.
+    patch:
+      default:
+        target: 50%
+        informational: true
+    # Per-flag thresholds (server flag already configured in ci.yml).
+    # Add cli, desktop, etc. as their coverage toolchains ship.
+    flags:
+      server:
+        target: 80%
+        informational: true
+
+# PR comments disabled for now: solo dev, low PR traffic, low signal at 32 tests.
+comment: false
+
+# Group admin paths that should not count toward coverage.
+ignore:
+  - ".nuxt/**"
+  - ".output/**"
+  - "prisma/client/**"
+  - "proto/**"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "test/**"

.coderabbit.yaml

@@ -0,0 +1,33 @@
+# CodeRabbit configuration
+# https://docs.coderabbit.ai/guides/configure-coderabbit
+
+language: en-US
+early_access: true
+
+reviews:
+  request_changes_workflow: false
+  profile: chill
+  high_level_summary: true
+  review_status: true
+  commit_messages: true
+  suggested_labels: true
+  poem: false
+  path_filters:
+    - "!**/target/**"
+    - "!**/node_modules/**"
+    - "!**/.nuxt/**"
+    - "!**/.output/**"
+    - "!**/coverage/**"
+    - "!**/dist/**"
+    - "!**/.git/**"
+
+# Auto-review on PRs
+auto_review:
+  enabled: true
+  drafts: false
+  ignore_title_keywords:
+    - "WIP"
+    - "DRAFT"
+
+chat:
+  auto_reply: true

.editorconfig

@@ -0,0 +1,32 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.rs]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+# Makefiles require tabs (syntax)
+[Makefile]
+indent_style = tab
+
+# Nix files: prettier handles formatting, allow 2-space indent
+[*.nix]
+indent_style = space
+indent_size = 2
+
+# JSON files: Prettier handles formatting with 2-space indent
+[*.json]
+indent_style = space
+indent_size = 2

.env.example

@@ -0,0 +1,5 @@
+# Drop environment configuration
+# See server/.env.example for full reference
+DATABASE_URL="postgres://drop:drop@127.0.0.1:5432/drop"
+EXTERNAL_URL="http://localhost:3000"
+NUXT_PORT=4000

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Security-sensitive routes — require review
+# Auth: webauthn, passkey, MFA, OIDC, TOTP
+/server/server/api/v1/auth/ @BillyOutlast
+/server/server/internal/auth/ @BillyOutlast
+
+# Metadata providers — external HTTP integration, complex fallthrough
+/server/server/internal/metadata/ @BillyOutlast
+
+# Nitro server core (server/ dir)
+/server/server/ @BillyOutlast
+
+# Build, deps, CI
+/server/.env.example @BillyOutlast
+/.github/workflows/ @BillyOutlast
+/AGENTS.md @BillyOutlast
+/CLAUDE.md @BillyOutlast
+/CONTRIBUTING.md @BillyOutlast

.github/dependabot.yml

@@ -0,0 +1,159 @@
+version: 2
+
+registries:
+  # Allow Dependabot to resolve private/skipped registry hosts from lockfiles
+  # (e.g. buf schema registry, GitHub Packages). Public registries need no entry.
+  npm-pkg-github:
+    type: "npm-registry"
+    url: "https://npm.pkg.github.com"
+    token: "${{secrets.GITHUB_TOKEN}}"
+
+updates:
+  # ----- Node / pnpm workspace (root, server, sites/*, desktop) -----
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 10
+    groups:
+      # Patch + minor bumps bundled together to avoid PR spam
+      node-minor:
+        update-types: ["minor", "patch"]
+      # Pin major bumps separately for explicit review
+      node-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps"
+      prefix-development: "chore(deps-dev)"
+    labels: ["dependencies", "javascript"]
+    reviewers: ["BillyOutlast"]
+    # Keep lockfile in sync; pnpm-workspace.yaml declares onlyBuiltDependencies
+    # — keep Dependabot from re-enabling builds that the workspace intentionally skips.
+    rebase-strategy: "auto"
+
+  # ----- Nuxt 4 desktop app (separate pnpm workspace) -----
+  # desktop/main/ has its own pnpm-workspace.yaml and pnpm-lock.yaml,
+  # so root npm entry at "/" does not cover it. Scanned independently.
+  - package-ecosystem: "npm"
+    directory: "/desktop/main"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      desktop-minor:
+        update-types: ["minor", "patch"]
+      desktop-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(desktop)"
+    labels: ["dependencies", "javascript"]
+    rebase-strategy: "auto"
+
+  # ----- Rust workspace: CLI -----
+  - package-ecosystem: "cargo"
+    directory: "/cli"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      rust-minor:
+        update-types: ["minor", "patch"]
+      rust-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(cli)"
+    labels: ["dependencies", "rust"]
+
+  # ----- Rust workspace: droplet library -----
+  - package-ecosystem: "cargo"
+    directory: "/libraries/droplet"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      rust-minor:
+        update-types: ["minor", "patch"]
+      rust-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(droplet)"
+    labels: ["dependencies", "rust"]
+
+  # ----- Rust workspace: native_model library -----
+  - package-ecosystem: "cargo"
+    directory: "/libraries/native_model"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      rust-minor:
+        update-types: ["minor", "patch"]
+      rust-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(native_model)"
+    labels: ["dependencies", "rust"]
+
+  # ----- Rust workspace: desktop (Tauri) -----
+  - package-ecosystem: "cargo"
+    directory: "/desktop/src-tauri"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    groups:
+      rust-minor:
+        update-types: ["minor", "patch"]
+      rust-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(desktop)"
+    labels: ["dependencies", "rust"]
+
+  # ----- Dockerfile (root image) -----
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps(docker)"
+    labels: ["dependencies", "docker"]
+
+  # ----- GitHub Actions -----
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/New_York"
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor:
+        update-types: ["minor", "patch"]
+      actions-major:
+        update-types: ["major"]
+    commit-message:
+      prefix: "deps(ci)"
+    labels: ["dependencies", "github-actions"]