grey-box
diff --git a/‎.claude/settings.local.json‎
Lines changed: 7 additions & 0 deletions b/‎.claude/settings.local.json‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎.env.example‎
Lines changed: 12 additions & 0 deletions b/‎.env.example‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 8 additions & 8 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 8 additions & 8 deletions
diff --git a/‎.github/workflows/release.yml‎
Lines changed: 5 additions & 5 deletions b/‎.github/workflows/release.yml‎
Lines changed: 5 additions & 5 deletions
diff --git a/‎.github/workflows/security.yml‎
Lines changed: 74 additions & 0 deletions b/‎.github/workflows/security.yml‎
Lines changed: 74 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 48 additions & 8 deletions b/‎.gitignore‎
Lines changed: 48 additions & 8 deletions
diff --git a/‎.markdownlint.json‎
Lines changed: 8 additions & 0 deletions b/‎.markdownlint.json‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎.markdownlintignore‎
Lines changed: 5 additions & 0 deletions b/‎.markdownlintignore‎
Lines changed: 5 additions & 0 deletions
@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(wc:*)"
+    ]
+  }
+}
@@ -0,0 +1,12 @@
+# Backend environment configuration
+# Copy this file to .env and fill in your values.
+# .env is gitignored — never commit it.
+
+# Logging level for the FastAPI application (DEBUG | INFO | WARNING | ERROR)
+LOG_LEVEL=INFO
+
+# Enable FastAPI debug mode (set to false in production)
+FASTAPI_DEBUG=false
+
+# Default semantic similarity threshold (0.0 – 1.0)
+SIMILARITY_THRESHOLD=0.65
@@ -23,9 +23,9 @@ jobs:
       run:
         working-directory: symmetry-unified-backend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: "3.11"
           cache: pip
@@ -38,11 +38,11 @@ jobs:
         run: python -m spacy download en_core_web_sm
 
       - name: Run tests
-        run: pytest -m "not slow and not external" --tb=short --junitxml=report.xml
+        run: python -m pytest -m "not slow and not external" --tb=short --junitxml=report.xml
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: backend-test-results
           path: symmetry-unified-backend/report.xml
@@ -51,7 +51,7 @@ jobs:
     name: Frontend Docker Build & Smoke Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Docker image
         run: docker build -t symmetry-frontend:test ./desktop-electron-frontend
@@ -89,9 +89,9 @@ jobs:
       run:
         working-directory: desktop-electron-frontend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: "18"
           cache: npm
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [backend-test, frontend-build]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Start services
         run: docker compose up -d --build
 
@@ -27,7 +27,7 @@ jobs:
       new_version: ${{ steps.tag.outputs.new_version }}
       changelog: ${{ steps.tag.outputs.changelog }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -41,7 +41,7 @@ jobs:
           release_branches: main
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         with:
           tag_name: ${{ steps.tag.outputs.new_tag }}
           name: Release ${{ steps.tag.outputs.new_tag }}
@@ -68,18 +68,18 @@ jobs:
           - context: desktop-electron-frontend
             image: frontend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: ghcr.io/${{ github.repository }}/${{ matrix.image }}
           tags: |
 
@@ -0,0 +1,74 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    # Run every Monday at 08:00 UTC
+    - cron: '0 8 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  python-audit:
+    name: Python Dependency Audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: symmetry-unified-backend
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "3.11"
+
+      - name: Install pip-audit
+        run: pip install pip-audit
+
+      - name: Audit Python dependencies
+        run: pip-audit -r requirements.txt --desc on
+
+  python-lint:
+    name: Python Lint (ruff)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: symmetry-unified-backend
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff
+        run: ruff check .
+
+  node-audit:
+    name: Node.js Dependency Audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: desktop-electron-frontend
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: "18"
+          cache: npm
+          cache-dependency-path: desktop-electron-frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit Node.js dependencies
+        run: npm audit --audit-level=high
@@ -1,10 +1,50 @@
-venv
-frontend.log
-symmetry-unified-backend/log_pytest.txt
-backend_test.log
-backend.log
+# ── Python ────────────────────────────────────────────────────
+venv/
+.venv/
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.so
+*.egg
+*.egg-info/
+dist/
+build/
+.eggs/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/
+*.log
+log_pytest.txt
 datasets/
-.DS_Store
-**/tempCodeRunnerFile.py
-# Build artifacts
+
+# ── Node / Electron ───────────────────────────────────────────
+node_modules/
 /desktop-electron-frontend/dist/
+/desktop-electron-frontend/.vite/
+/desktop-electron-frontend/out/
+/desktop-electron-frontend/artifacts/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# ── Local config & secrets ────────────────────────────────────
+.env
+config.json
+
+# ── OS / Editor ───────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+.vscode/settings.json
+.idea/
+
+# ── Logs ──────────────────────────────────────────────────────
+frontend.log
+backend.log
+backend_test.log
+*.log
+symmetry-unified-backend/report.xml
+test-results/
+desktop-electron-frontend/playwright-report/*
@@ -0,0 +1,8 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD024": false,
+  "MD036": false,
+  "MD040": false,
+  "MD060": false
+}
@@ -0,0 +1,5 @@
+node_modules/
+symmetry-unified-backend/venv/
+desktop-electron-frontend/node_modules/
+desktop-electron-frontend/test-results/
+test-results/