Accounts: sign-up, sign-in and recovery rebuilt

.clj-kondo/config.edn

@@ -107,6 +107,11 @@
              (orcpub.routes-test/with-conn)
              (orcpub.routes.folder-test/with-conn)
              (orcpub.email-change-test/with-conn)
+             (orcpub.routes.public-reads-test/with-conn)
+             (orcpub.routes.item-save-test/with-conn)
+             (orcpub.routes.share-test/with-conn)
+             (orcpub.routes.party-test/with-conn)
+             (orcpub.heartbeat-test/with-conn)
              (user/with-db)]}}
  ;; native/cljs and web/cljs are separate source roots; kondo doesn't know
  ;; about them so ns names appear to mismatch their file paths.

.githooks/pre-push

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# pre-push guard (reminder, not an auto-fold): refuse to push a commit that still
+# carries docs/branch-changelog.md onto integration / develop / main. Mirrors
+# .github/workflows/changelog-guard.yml so a forgotten fold is caught locally
+# instead of on CI. The fold itself stays a deliberate manual step:
+#   scripts/fold-branch-changelog.sh "<release>"    (then commit, then push)
+#
+# Activate once per clone:  scripts/setup-hooks.sh   (or: git config core.hooksPath .githooks)
+
+status=0
+zero="0000000000000000000000000000000000000000"
+
+# Current in-progress release = the first "## [Name]" in CHANGELOG.md, so the
+# suggested fold command is copy-pasteable. Falls back to a placeholder.
+release="$(grep -m1 -oE '^## \[[^]]+\]' CHANGELOG.md 2>/dev/null | sed -E 's/^## \[(.+)\]$/\1/')"
+release="${release:-<release>}"
+
+while read -r _local_ref local_sha remote_ref _remote_sha; do
+  [ "$local_sha" = "$zero" ] && continue                    # branch deletion — skip
+  case "$remote_ref" in
+    refs/heads/integration|refs/heads/develop|refs/heads/main)
+      guarded=1
+      if git cat-file -e "${local_sha}:docs/branch-changelog.md" 2>/dev/null; then
+        target="${remote_ref#refs/heads/}"
+        echo "" >&2
+        echo "  pre-push blocked: docs/branch-changelog.md is still un-folded on the commit" >&2
+        echo "  bound for '${target}'. Fold it into CHANGELOG.md, then commit and re-push:" >&2
+        echo "" >&2
+        echo "      scripts/fold-branch-changelog.sh \"${release}\"" >&2
+        echo "" >&2
+        echo "  (Decide whether this branch earned a '## Highlights' before folding —" >&2
+        echo "   see docs/branch-changelog.template.md. To bypass once: git push --no-verify.)" >&2
+        echo "" >&2
+        status=1
+      fi
+      ;;
+  esac
+done
+
+# Same rules CI applies, run here so a style problem is a local message rather than
+# a red build after the merge. Skipped when python3 is absent; CI still catches it.
+if [ "${guarded:-0}" = "1" ] && [ -x scripts/lint-changelog.py ] && command -v python3 >/dev/null 2>&1; then
+  if ! scripts/lint-changelog.py >/dev/null 2>&1; then
+    echo "" >&2
+    echo "  pre-push blocked: CHANGELOG.md does not follow the house style." >&2
+    echo "" >&2
+    scripts/lint-changelog.py 2>&1 | sed -E 's/^::error [^:]*::/    /; s/^/  /' >&2
+    echo "" >&2
+    echo "  House style: docs/branch-changelog.template.md" >&2
+    echo "  (To bypass once: git push --no-verify.)" >&2
+    echo "" >&2
+    status=1
+  fi
+fi
+
+exit $status

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,4 +7,5 @@
   - [ ] I have commented my code, particularly in hard-to-understand areas
   - [ ] I have made corresponding changes to the documentation if necessary
   - [ ] There is no commented out code in this PR.
-  - [ ] My changes generate no new warnings (check the console)
+  - [ ] My changes generate no new warnings (check the console)
+  - [ ] `docs/branch-changelog.md` is updated in the house style (`docs/branch-changelog.template.md`), and I decided whether this branch earns a `## Highlights`.

.github/workflows/changelog-guard.yml

@@ -0,0 +1,48 @@
+# Guard: a branch changelog must be FOLDED into CHANGELOG.md (and removed) before
+# landing on integration or develop. See docs/CONTRIBUTING.md.
+#
+# Runs on push (the post-merge backstop): if a merge landed on integration/develop
+# without folding its docs/branch-changelog.md, this goes red — run
+# scripts/fold-branch-changelog.sh, commit, and push again. Not run on
+# pull_request, since the branch changelog legitimately lives on the feature branch
+# until it is folded at merge time.
+
+name: Changelog guard
+
+# The fold guard is a post-merge backstop and only makes sense on push. The style
+# lint is the opposite: it is feedback, so it also runs on pull_request, where the
+# author can still act on it. Both are in one workflow because they are one topic.
+on:
+  push:
+    branches: [integration, develop, main]
+  pull_request:
+    paths: ["CHANGELOG.md", "scripts/lint-changelog.py", ".github/workflows/changelog-guard.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  branch-changelog-folded:
+    name: Branch changelog folded
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: A branch changelog must be folded before landing here
+        run: |
+          if [ -f docs/branch-changelog.md ]; then
+            echo "::error file=docs/branch-changelog.md::An un-folded branch changelog is present on $GITHUB_REF_NAME. Fold it into CHANGELOG.md and remove it before landing — run: scripts/fold-branch-changelog.sh \"<release>\""
+            exit 1
+          fi
+          echo "OK — no un-folded branch changelog on $GITHUB_REF_NAME."
+
+  changelog-style:
+    name: Changelog house style
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # No setup step: ubuntu-latest ships python3, and the linter imports nothing
+      # outside the standard library on purpose, so this stays a checkout and a run.
+      - name: CHANGELOG.md follows docs/branch-changelog.template.md
+        run: scripts/lint-changelog.py --stats

.gitignore

@@ -22,8 +22,12 @@ pom.xml
 /classes/
 /out/
 /target/
-/node_modules/
-.clj-kondo
+# no trailing slash: the e2e tooling is run by symlinking this to a sibling checkout's copy,
+# and a trailing slash matches only a real directory
+/node_modules
+# the linter's cache, not its config: config.edn is tracked and must stay addable
+.clj-kondo/*
+!.clj-kondo/config.edn
 .calva
 .lein-deps-sum
 .lein-repl-history
@@ -50,7 +54,10 @@ deploy/homebrew/*
 branch-sync-plan.md
 dev/test-accounts.edn
 
-# E2E test artifacts
+# E2E test artifacts. Unanchored, because a leading slash pins the pattern to the
+# repo root: /node_modules/ and /e2e/node_modules/ both missed the real one at
+# scripts/e2e/node_modules, and 179 files of it went into a commit.
+node_modules/
 /e2e/node_modules/
 /e2e/playwright-report/
 /e2e/test-results/
@@ -71,12 +78,19 @@ cljs-test-runner-out
 # Cursor IDE local config (contains user-specific paths)
 .cursor/
 
-# Claude Code local data (conversation history, credentials)
+# Local assistant tool state (conversation history, credentials) — belongs in dotfiles,
+# not in a code branch
 .claude-data/
-
-# Agentic/AI tool files — belong in dotfiles or agents/ branch, not code branches
 .claude/
 
+# The agent entry point. Versioned on agents/develop, the agentic silo, and copied into a
+# working tree per environment by scripts/agent-setup.sh. Ignored here because this branch
+# ships to the public repo: an untracked copy is one `git add -A` away from being committed,
+# which is how it drifted onto code branches before, and why the restructure deleted it.
+# Note `.claude/` above does NOT cover this — that is a directory, and CLAUDE.md is a file
+# at the repo root.
+/CLAUDE.md
+
 # NewRelic (DMV-specific, contains license key)
 newrelic*
 
@@ -101,8 +115,30 @@ cljsjs/
 # Local devcontainer setup (superseded by dotfiles)
 .devcontainer/local-setup.sh
 
-# Design handoff reference material (preserved on agents/develop, not committed to code branches)
+# Design handoff reference material (kept out of the code branches)
 design_handoff_character_menus
 
 # Generated clojure-CLI cljs build artifact (regenerated from project.clj; lein/figwheel-main is canonical)
 /deps.edn
+
+# Deploy-injected static vendor assets (font-awesome, etc.). index.clj references
+# /assets/... at runtime, but these binaries are provided at deploy time and are
+# not part of the source tree. A local copy may exist to render the screenshot
+# harness faithfully; never commit the vendored fonts/CSS.
+/resources/public/assets/
+/package-lock.json
+
+# Perf-investigation scratch: throwaway probe scripts and the multi-megabyte .orcbrew
+# packs generated by dev/scale_orcbrew_pack.clj. The harnesses worth keeping live in
+# test/browser/; the packs are regenerable and must not be committed.
+/dev-scratch/
+dev-scratch/shots/
+
+# Throwaway probe scripts at repo root (_pop.js, _mob.js …). Real probes live in
+# test/browser/ — see docs/kb/fast-browser-probes.md. This stops `git add -A` sweeping
+# a hardcoded-path scratch file into a commit, which happened twice in one session.
+_*.js
+
+# Python bytecode from scripts/ (scripts/lint-changelog.py is run, not imported)
+__pycache__/
+*.pyc