Add evidence-first DISHA Brain spine

.env.example

@@ -1,54 +1,51 @@
-# ─────────────────────────────────────────────
-# DISHA AGI Platform — Environment Variables
-# ─────────────────────────────────────────────
-# Copy this file to .env and fill in your values.
-
-# ── Core CLI (Layer 1) ──────────────────────
-ANTHROPIC_API_KEY=sk-ant-...          # Required for Anthropic Claude API access
-
-# ── AI Platform Backend (Layer 2) ───────────
-OPENAI_API_KEY=sk-...                 # OpenAI API key (for LangChain agents)
-NEO4J_URI=bolt://neo4j:7687           # Neo4j connection URI (for Docker)
-NEO4J_USER=neo4j                      # Neo4j username
-NEO4J_PASSWORD=disha-neo4j-pass       # Neo4j password
-POSTGRES_PASSWORD=postgres            # Postgres password
-CHROMA_HOST=chromadb                  # ChromaDB host
-CHROMA_PORT=8000                      # ChromaDB port
-SECRET_KEY=disha-secret-key-change-me # JWT secret
+# DISHA environment variables
+# Copy this file to .env and replace every <...> placeholder before deployment.
+# Do not commit real keys, tokens, passwords, private endpoints, or production secrets.
+
+# Core CLI
+ANTHROPIC_API_KEY=<set-anthropic-api-key>
+
+# AI Platform Backend
+OPENAI_API_KEY=<set-openai-api-key>
+NEO4J_URI=bolt://neo4j:7687
+NEO4J_USER=neo4j
+NEO4J_PASSWORD=<set-neo4j-password>
+POSTGRES_PASSWORD=<set-postgres-password>
+CHROMA_HOST=chromadb
+CHROMA_PORT=8000
+SECRET_KEY=<set-jwt-secret>
 CORS_ORIGINS=http://localhost:3000,http://localhost:3001
 
-# ── Cyber Defense (Layer 3) ─────────────────
-COWRIE_SSH_PORT=2222                  # External SSH port for cowrie
-OPENCANARY_HTTP_PORT=8081             # External HTTP port for opencanary
-ELASTIC_PORT=9200                     # Elasticsearch port
+# Cyber Defense
+COWRIE_SSH_PORT=2222
+OPENCANARY_HTTP_PORT=8081
+ELASTIC_PORT=9200
 
-# ── Physics Engine ──────────────────────────
-NASA_API_KEY=DEMO_KEY                 # NASA API key for astronomy data
-PHYSICS_API_PORT=8002                 # Port for physics backend
+# Physics Engine
+NASA_API_KEY=<set-nasa-api-key-or-demo-key>
+PHYSICS_API_PORT=8002
 
-# ── Feature Flags (CLI) ────────────────────
-# Set to '1' or 'true' to enable
+# Optional CLI feature flags. Set to 1 or true to enable.
 # CLAUDE_CODE_BRIDGE_MODE=0
 # CLAUDE_CODE_DAEMON=0
 # CLAUDE_CODE_VOICE_MODE=0
 # CLAUDE_CODE_BG_SESSIONS=0
 
-# ── DISHA Brain (Unified Backend + Edge Agent) ─────────────────────
-# Brain backend (FastAPI)
-DISHA_BRAIN_API_HOST=0.0.0.0
+# DISHA Brain backend
+DISHA_BRAIN_API_HOST=127.0.0.1
 DISHA_BRAIN_API_PORT=8080
-DISHA_BRAIN_API_TOKEN=change-me
+DISHA_BRAIN_API_TOKEN=<set-disha-brain-api-token>
 DISHA_BRAIN_DB_PATH=./data/disha_brain.db
 DISHA_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001
 DISHA_WORKSPACE_ROOT=.
 
-# Edge agent (telemetry sender)
+# Edge agent
 DISHA_BRAIN_BACKEND_URL=http://127.0.0.1:8080
 DISHA_BRAIN_DEVICE_ID=desktop
 DISHA_BRAIN_USER_ID=local-user
 DISHA_BRAIN_AGENT_INTERVAL=15
 
-# Optional module endpoints (DISHA Brain adapters)
+# Optional module endpoints used by DISHA Brain adapters
 DISHA_AI_PLATFORM_URL=http://127.0.0.1:8000/api/v1
 DISHA_MCP_HTTP_URL=http://127.0.0.1:4000
 DISHA_PHYSICS_URL=http://127.0.0.1:8002

.github/codeql-config.yml

@@ -13,6 +13,18 @@
 # All other CodeQL security rules remain fully active for the entire repo.
 name: "Disha CodeQL Config"
 
+paths:
+  - web
+  - docs
+  - .github
+
+paths-ignore:
+  - legacy/**
+  - disha/apps/**
+  - disha/services/**
+  - disha/ai/**
+  - disha/mobile/**
+
 query-filters:
   - exclude:
       id: py/clear-text-logging-sensitive-data

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      web-runtime:
+        patterns:
+          - next
+          - react
+          - react-dom
+          - "@next/*"
+      web-tooling:
+        patterns:
+          - typescript
+          - vitest
+          - eslint
+          - eslint-config-next
+          - "@types/*"

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: DISHA Product CI
 
 on:
   push:
@@ -9,37 +9,34 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: disha-product-ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  lint:
-    name: Lint (TypeScript)
+  web:
+    name: Web product verification
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v5
         with:
-          bun-version: "1.3.11"
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Lint (Biome)
-        run: bun run lint
-
-  test-typescript:
-    name: Unit Tests (TypeScript / Bun)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
+        run: npm ci
 
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.11"
+      - name: Type-check
+        run: npm run type-check
 
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
+      - name: Test
+        run: npm test
 
-      - name: Run tests
-        run: bun run test
+      - name: Build
+        run: npm run build

.github/workflows/codeql.yml

@@ -47,6 +47,8 @@ jobs:
           build-mode: none
         - language: javascript-typescript
           build-mode: none
+        - language: go
+          build-mode: autobuild
         - language: python
           build-mode: none
         # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
@@ -100,5 +102,6 @@ jobs:
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3
+      continue-on-error: true
       with:
         category: "/language:${{matrix.language}}"