Complete the authenticated, persistent Google review pilot

.agent/CONTINUITY.md

@@ -0,0 +1,38 @@
+# AutoReview implementation continuity
+
+## Snapshot
+
+- Branch: `codex/production-pilot`, based on `dev`.
+- Goal: replace demonstration-only paths with a safe, usable manually approved pilot.
+- No live Google, OpenRouter or cloud credentials supplied. Never claim production verification without them.
+
+## Progress
+
+- Persistent tenant-scoped PostgreSQL repository, CAS batches, forced RLS, append-only audit and expiry implemented.
+- Google OAuth nonce, authorized location import/sync/disconnect and canonical review revalidation implemented.
+- Recoverable publication intent and GET-only uncertain-outcome reconciliation implemented and tested.
+- Identity Platform/TOTP, account grant/revocation checks, KMS vault and secure web/native sessions implemented.
+- Versioned knowledge/document extraction and Vertex/pgvector hybrid retrieval implemented; no automatic learning.
+- Web/mobile inboxes and review actions, sources, knowledge lifecycle, rules/simulation, preferences and audit wired to API.
+- Content-free push outbox, Expo ticket checks, invalid-device removal and scheduled retries implemented.
+- Terraform identity/web/worker/migrations/retention/initial monitoring validated; no cloud apply performed.
+- English README and engineering/setup/API/release docs distinguish implemented pilot from unverified production gates.
+- User confirmed no approved Google Cloud Business Profile project. Live connection remains external.
+
+## Verification
+
+- 70 automated tests pass; one optional TCP PostgreSQL test skipped without TEST_DATABASE_URL.
+- Six Playwright desktop/mobile-web scenarios pass; all seven workspace typechecks/builds pass.
+- Android/iOS Hermes exports pass; these are not signed APK/IPA or physical-device tests.
+- Biome, diff whitespace, Terraform fmt/validate pass. CI expanded; inspect exact pushed head before reporting its result.
+- PDF native worker-thread crash on Windows fixed with a bounded child process; real PDF/DOCX extraction tests pass.
+- Test/dev server cleanup and Hermes compiler require appropriate Windows execution permissions, not source workarounds.
+
+## Decisions
+
+- Manual approval remains the default. Automatic publication must fail closed.
+- Keep mock adapters explicit and prohibited in production.
+- Use small commits. PR target must be `dev`; do not update `main` directly.
+- Runtime SQL user must be non-owner, NOSUPERUSER/NOBYPASSRLS/NOCREATEROLE/NOCREATEDB. Fresh cloud bootstrap: targeted migration job provisioning, execute it, then full apply.
+- No SaaS billing/team self-service, original document archive, correction dataset, full OTel or Expo receipt analytics shipped; these are documented expansion scope.
+- Integrate remote dev audit: preserve location/limit filtering, parameterized SQL and generation failure audit; pre-PUT failures are recoverable while uncertain PUT outcomes require GET-only reconciliation.

.dockerignore

@@ -5,6 +5,9 @@ node_modules
 **/dist-ios
 **/.next
 .git
+.agent/tools
+**/test-results
+**/playwright-report
 .env
 .env.*
 !.env.example

.env.example

@@ -1,5 +1,6 @@
 NODE_ENV=development
 PORT=4100
+HOST=127.0.0.1
 WORKER_PORT=4200
 WORKER_AUTH_MODE=demo
 WORKER_PUBLIC_URL=http://localhost:4200
@@ -13,6 +14,17 @@ INTERNAL_WORKER_SECRET=reviewguard-local-worker-secret
 GOOGLE_WEBHOOK_TENANT_ID=11111111-1111-4111-8111-111111111111
 GOOGLE_WEBHOOK_ACTOR_ID=22222222-2222-4222-8222-222222222222
 AUTH_MODE=demo
+STORAGE_MODE=memory
+# Required only for local persistent development; production uses GOOGLE_KMS_KEY_NAME.
+TOKEN_ENCRYPTION_KEY=
+IDENTITY_PROJECT_ID=
+IDENTITY_API_KEY=
+WEB_AUTH_MODE=demo
+AUTH_COOKIE_SECRET=
+AUTOMATION_RELEASE_APPROVED=false
+EMBEDDING_MODE=demo
+EMBEDDING_MODEL=gemini-embedding-001
+EMBEDDING_LOCATION=europe-west4
 DATABASE_URL=postgres://reviewguard:reviewguard@localhost:5432/reviewguard
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
@@ -26,5 +38,9 @@ OPENROUTER_MODEL=deepseek/deepseek-v4-pro-0813
 OPENROUTER_PROVIDER_ALLOWLIST=
 AI_MODE=mock
 WEB_ORIGIN=http://localhost:3000
-NEXT_PUBLIC_API_URL=http://localhost:4100/v1
+EXPO_PUBLIC_AUTH_MODE=demo
+EXPO_PUBLIC_IDENTITY_API_KEY=
+EXPO_PUBLIC_EAS_PROJECT_ID=
 EXPO_PUBLIC_API_URL=http://localhost:4100/v1
+# Optional: required when Expo push access-token enforcement is enabled.
+EXPO_ACCESS_TOKEN=

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, dev, 'codex/**']
 
 permissions:
   contents: read
@@ -24,6 +24,16 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - run: pnpm build
+      - run: pnpm --filter @reviewguard/web exec playwright install --with-deps chromium
+      - run: pnpm test:e2e
+      - run: pnpm --filter @reviewguard/mobile exec expo export --platform android --output-dir dist-android
+      - run: pnpm --filter @reviewguard/mobile exec expo export --platform ios --output-dir dist-ios
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: browser-test-diagnostics
+          path: apps/web/test-results/
+          retention-days: 3
 
   terraform:
     runs-on: ubuntu-latest

.gitignore

@@ -1,11 +1,14 @@
 node_modules/
 .pnpm-store/
 .turbo/
+.agent/tools/
 .next/
 dist/
 dist-android/
 dist-ios/
 coverage/
+test-results/
+playwright-report/
 .expo/
 .env
 .env.local