Non-negotiable structural rules that apply to every Claude Code session in
this repo and to every commit, enforced via three defense-in-depth layers:
1. PreToolUse hook in .claude/settings.json blocks any Write/Edit that
would push a file past the 500-line hard cap. Auto-loads for any
Claude session in this repo regardless of who launched it.
2. scripts/githooks/pre-commit (installed via scripts/install-hooks.sh)
enforces the LOC cap, freezes migrations/ unless [migration-approved],
and protects guardrail files unless [guardrail-change] is present.
3. .gitea/workflows/ci.yaml gets loc-budget + guardrail-integrity jobs,
plus mypy --strict on new Python packages, tsc --noEmit on Node
services, and a syft+grype SBOM scan.
Per-language conventions are documented in AGENTS.python.md / AGENTS.go.md /
AGENTS.typescript.md at the repo root — layering (router->service->repo for
Python, hexagonal for Go, colocation for Next.js), tooling baseline, and
explicit "what you may NOT do" lists.
Adds scripts/check-loc.sh (soft 300 / hard 500, reports 205 hard and 161
soft violations in the current codebase) plus .claude/rules/loc-exceptions.txt
(initially empty — the list is designed to shrink over time).
Per-service READMEs for all 10 services + PHASE1_RUNBOOK.md for the
backend-compliance refactor. Skeleton packages (compliance/{domain,
repositories,schemas}) are the landing zone for the clean-arch rewrite that
begins in Phase 1.
CLAUDE.md is prepended with the six non-negotiable rules.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The runner container has Docker socket but no host filesystem access.
docker compose needs to read YAML files, so run build+deploy inside
a helper container that has both Docker socket and the deploy dir mounted.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Problems fixed:
1. Deploy step couldn't access /opt/breakpilot-compliance (host path not
mounted in runner container). Now uses alpine/git helper container with
host bind-mount for git ops, then docker compose with host paths.
2. breakpilot-network was external:true but Core doesn't run on Hetzner.
Override in hetzner.yml creates the network automatically.
3. core-health-check blocks startup waiting for Core. Override in
hetzner.yml makes it exit immediately.
4. RAG ingestion script now respects RAG_URL/QDRANT_URL env vars.
5. RAG workflow discovers network dynamically from running containers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Gitea Actions CI um deploy-hetzner Job erweitert
- Automatischer Build + Deploy bei Push auf main (nach Tests)
- docker-compose.hetzner.yml Override (amd64 statt arm64)
- Deploy-Dir: /opt/breakpilot-compliance/
- Baut parallel: admin, backend, ai-sdk, developer-portal
- Health Checks nach Deploy
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The ai-compliance-sdk go.mod requires go >= 1.24.0 but CI was using
golang:1.23-alpine. Updated both Gitea Actions and Woodpecker pipelines.
Also updated golangci-lint to v1.62 for Go 1.24 compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The act_runner cannot create /home/act_runner cache dir inside
container images. Replace actions/checkout@v4 with manual
git clone using GITHUB_SERVER_URL and GITHUB_REPOSITORY env vars.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Adds .gitea/workflows/ci.yaml with lint and test jobs.
Runs on gitea.meghsakha.com with Gitea Actions runner.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
