chore: post-pivot cleanup — update CLAUDE.md, gitignore site/, remove orphan test

Author: mariuspruvot

.gitignore

@@ -16,6 +16,7 @@ npm-debug.log*
 
 # Build outputs
 apps/web/dist/
+site/
 
 # Environment
 .env

CLAUDE.md

@@ -9,33 +9,57 @@ make migrate                     # Alembic upgrade head
 
 ## Architecture
 
-Monorepo with two apps and shared infra:
+Monorepo with two apps, skills, and shared infra. See [ADR-001](docs/adr-001-claude-code-container-pivot.md) for the pivot decision.
 
 ```
 apps/api/          — FastAPI backend (Python 3.12, uv)
   src/helprs/
     core/          — config, database, dependencies, exceptions, middleware, security
-    modules/       — domain modules: identity, installation, webhook, billing, comprehension
-    admin/         — SQLAdmin panel
+    modules/       — domain modules: identity, installation, webhook, container (Phase 2)
+    admin/         — SQLAdmin panel + credential management
   tests/           — mirrors modules/ structure
   alembic/         — DB migrations
 apps/web/          — React frontend (Vite, TypeScript)
-  src/features/    — feature modules: auth, demo, installation, session
+  src/features/    — feature modules: auth, dashboard, installation, session
   src/shared/      — shared components/utils
+skills/            — Claude Code skill definitions (mounted into ephemeral containers)
 infra/
-  docker/          — Dockerfiles (api, web)
+  docker/          — Dockerfiles (api, web, claude-runner)
   coolify/         — production docker-compose
 ```
 
+## How It Works
+
+1. GitHub PR event hits the webhook receiver
+2. API posts a PR comment with a session link
+3. User clicks the link (or auto-trigger if configured)
+4. Backend spins up an ephemeral Docker container with Claude Code CLI
+5. Container runs the assigned skill against the PR (using `gh` CLI for fast checkout)
+6. Results stream back via SSE passthrough to the frontend
+7. Container is destroyed after completion or timeout
+
+**Key**: Users provide their Claude credentials once in the admin panel (BYOK). The backend never calls the Claude API directly -- containers use the credentials natively via Claude Code CLI.
+
 ## Key Patterns
 
 - **App factory**: `helprs.main:create_app()` — lifespan manages DB engine
-- **Flat modules** (identity, installation, webhook, billing): `router.py`, `service.py`, `models.py`, `schemas.py`
-- **Layered modules** (comprehension): DDD layout — `domain/`, `application/`, `infrastructure/`, `presentation/`
-- **AI agents**: comprehension uses pydantic-ai agents (`infrastructure/agents.py`) with SSE streaming responses
+- **Flat modules** (identity, installation, webhook, container): `router.py`, `service.py`, `models.py`, `schemas.py`
+- **Container orchestration**: `container` module manages ephemeral Docker lifecycle, credential injection, result relay
+- **Skills as agents**: each skill is a self-contained folder with workflow definitions, mounted into containers
+- **SSE passthrough**: backend relays container output to frontend (no AI response generation in backend)
 - **API prefix**: all routes under `/api/v1`
 - **Admin panel**: SQLAdmin at `/admin`, configured in `admin/views.py`
 
+## Skills
+
+Skills are pluggable Claude Code agent definitions in `skills/`. See `skills/SKILL_SPEC.md` for the full specification.
+
+| Skill | Purpose | PR fetch strategy |
+|-------|---------|-------------------|
+| `challenge-me` | Socratic quiz on PR changes | Shallow clone |
+| `code-review` | Multi-layer adversarial review | Shallow clone |
+| `security-audit` | Vulnerability scan on diff | Diff only |
+
 ## Code Style
 
 - Python: ruff with `line-length = 120`, target Python 3.12
@@ -47,7 +71,6 @@ infra/
 ```bash
 cd apps/api && uv run pytest                              # All API tests
 cd apps/api && uv run pytest tests/modules/identity/      # Single module
-cd apps/api && uv run pytest tests/modules/comprehension/test_story_4_2.py  # Single file
 cd apps/web && npx vitest run                             # All frontend tests
 cd apps/api && uv run alembic revision --autogenerate -m "description"  # New migration
 ```
@@ -61,10 +84,19 @@ Required `.env` at repo root (see docker-compose.yml):
 - `DATABASE_URL` — Postgres connection string
 - `SECRET_KEY` — app secret
 - `GITHUB_APP_ID`, `GITHUB_WEBHOOK_SECRET` — GitHub App config
-- `FERNET_KEY` — encryption key for BYOK secrets
+- `FERNET_KEY` — encryption key for stored credentials
 
 ## Gotchas
 
 - Always run `make lint` before pushing — ruff + eslint must pass
 - DB migrations: `make migrate` inside Docker, or `cd apps/api && uv run alembic upgrade head` locally
 - Test conftest **must** set env vars before importing from `helprs.*`
+- **Agent-readiness**: This repo must be fully understandable by a fresh Claude Code instance with no prior context. Keep docs and CLAUDE.md accurate.
+- **Worktree merges**: Always `git stash --include-untracked` before merging worktree branches into main — uncommitted local changes cause modify/delete conflicts
+
+## Key Decisions
+
+- **Pre-pivot code**: preserved on branch `pre-pivot/v1`
+- **No pydantic-ai**: AI orchestration handled by Claude Code CLI in containers, not Python agent code
+- **BYOK via admin**: credentials stored once per user, injected as ephemeral env vars into containers
+- **Open source target**: designed for self-hosting with own Claude licenses