polish public beta UX and harden production flows

Author: thribhuvan003

.env.example

@@ -1,5 +1,4 @@
-# Vercel production paste list: config/vercel-env-paste.template
-# Quick table: config/VERCEL_ENV_KEYS.md
+# Deployment key reference: config/VERCEL_ENV_KEYS.md
 
 # App
 NEXT_PUBLIC_APP_URL=http://localhost:3000
@@ -19,7 +18,7 @@ GUEST_JWT_SECRET=change-me-minimum-32-characters-long
 # LLM generation — Groq is PRIMARY for all text + image (fast, reliable JSON).
 # Comma-separate multiple keys (gsk-...) to rotate rate limits.
 GROQ_API_KEYS=
-# qwen3.6-27b handles BOTH text + vision (fast, reliable JSON with thinking off).
+# Text and vision models are configured separately so either can be changed safely.
 GROQ_MODEL=openai/gpt-oss-120b
 GROQ_VISION_MODEL=qwen/qwen3.6-27b
 
@@ -43,19 +42,7 @@ CRON_SECRET=local-dev-cron-min-32-chars
 SUPERMEMORY_API_KEY=
 SUPERMEMORY_BASE_URL=http://localhost:6767
 
-# Observability
-LANGFUSE_PUBLIC_KEY=
-LANGFUSE_SECRET_KEY=
-LANGFUSE_BASE_URL=https://cloud.langfuse.com
-SENTRY_DSN=
-NEXT_PUBLIC_SENTRY_DSN=
-
-# Billing Phase 2
-RAZORPAY_KEY_ID=
-RAZORPAY_KEY_SECRET=
-RAZORPAY_WEBHOOK_SECRET=
-
-# Email Phase 2
+# Email reminders
 RESEND_API_KEY=
 RESEND_FROM_EMAIL=noreply@localhost
 
@@ -67,10 +54,6 @@ TWILIO_WHATSAPP_FROM=whatsapp:+14155238886
 # Optional dedicated SMS from-number (E.164). Trial: verify destination numbers.
 TWILIO_SMS_FROM=
 
-# Analytics
-NEXT_PUBLIC_POSTHOG_KEY=
-POSTHOG_API_KEY=
-
 # Rankings
 LEADERBOARD_MIN_SAMPLE=5
-LEADERBOARD_PUBLIC_ENABLED=false
+LEADERBOARD_PUBLIC_ENABLED=false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,34 @@
+name: Bug report
+description: Report a reproducible product defect without personal case data.
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include account numbers, documents, phone numbers, credentials, or other personal data.
+  - type: textarea
+    id: behaviour
+    attributes:
+      label: What happened?
+      description: Include the route, expected result, and actual result.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Safe reproduction
+      description: Use sample data only.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Browser and device
+      placeholder: Chrome 140, Android 15, Pixel 7
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check
+      options:
+        - label: I removed all personal data and secrets.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/thribhuvan003/unhold/security/advisories/new
+    about: Report vulnerabilities privately; never attach real case data.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Propose a focused improvement to the user-controlled case workflow.
+title: "[Feature]: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+      description: Describe the problem before proposing UI or implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundary
+    attributes:
+      label: Product boundary
+      options:
+        - label: This keeps external submissions review-before-send and makes no outcome guarantee.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      production-dependencies:
+        dependency-type: production
+      development-dependencies:
+        dependency-type: development
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3

.github/pull_request_template.md

@@ -0,0 +1,20 @@
+## User problem
+
+<!-- What becomes safer, clearer, or more reliable? -->
+
+## Changes
+
+<!-- Keep this concrete. -->
+
+## Safety and data impact
+
+- [ ] No secrets or real user data are included.
+- [ ] External communication remains review-before-send.
+- [ ] Authentication/authorisation and migration order were considered.
+- [ ] Product copy follows `docs/PRODUCT_AND_SAFETY.md`.
+
+## Verification
+
+- [ ] `pnpm verify`
+- [ ] `pnpm test:e2e:smoke` when a user journey changed
+- [ ] Mobile and keyboard checks when UI changed

.github/workflows/ci.yml

@@ -2,34 +2,104 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - "codex/**"
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: "true"
+  CRON_SECRET: ci-cron-secret-at-least-32-characters
+  GUEST_JWT_SECRET: ci-guest-secret-at-least-32-characters
+  NEXT_PUBLIC_SUPABASE_URL: http://127.0.0.1:54321
+  NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-anon-key
+  SUPABASE_SERVICE_ROLE_KEY: ci-service-role-key
 
 jobs:
   verify:
+    name: Static checks, tests, and build
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: pnpm/action-setup@v4
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b0f76dfb45f55f8421693e4803ac7bb65143bd34 # v6
 
-      - uses: actions/setup-node@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
           cache: pnpm
 
-      - name: Install
+      - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Lint
+        run: pnpm lint
+
       - name: Typecheck
         run: pnpm typecheck
 
-      - name: Unit + golden agent tests
+      - name: Unit and golden-agent tests
         run: pnpm test:unit
 
-      - name: API contract tests
+      - name: API and migration contracts
         run: pnpm test:contract
 
       - name: No-auto-send guard
         run: pnpm verify:no-auto-send
+
+      - name: Production build
+        run: pnpm build
+
+  secrets:
+    name: Current-tree secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 1
+
+      - name: Scan with Gitleaks 8.30.1
+        uses: docker://ghcr.io/gitleaks/gitleaks:v8.30.1
+        with:
+          args: dir . --redact --no-banner
+
+  browser-smoke:
+    name: Desktop and mobile browser smoke
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b0f76dfb45f55f8421693e4803ac7bb65143bd34 # v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Run smoke journeys
+        run: pnpm test:e2e:smoke

.github/workflows/cron.yml

@@ -1,17 +1,20 @@
 name: Unhold cron (job queue + tick)
 
+permissions:
+  contents: read
+
 # Vercel's Hobby plan allows only 2 daily crons (used by reminders + rankings in
 # vercel.json). Frequent job processing + monitor ticks run here instead — free,
 # works on any Vercel plan. On Vercel Pro you may instead add these to
 # vercel.json "crons" and disable this workflow.
 #
 # Required repo secrets (Settings → Secrets and variables → Actions):
-#   APP_URL      e.g. https://unholdd.vercel.app   (no trailing slash)
+#   APP_URL      e.g. https://www.unhold.live   (no trailing slash)
 #   CRON_SECRET  same value as the Vercel env var
 
 on:
   schedule:
-    - cron: '*/10 * * * *' # every 10 minutes (GitHub Actions minimum is 5)
+    - cron: "*/10 * * * *" # every 10 minutes (GitHub Actions minimum is 5)
   workflow_dispatch: {}
 
 concurrency:
@@ -24,15 +27,17 @@ jobs:
     steps:
       - name: Process job queue
         run: |
-          curl -fsS -m 280 -X POST "$APP_URL/api/v1/internal/jobs/process" \
-            -H "Authorization: Bearer $CRON_SECRET" || echo "jobs/process failed (non-fatal)"
+          curl --fail-with-body --silent --show-error --retry 2 --retry-all-errors \
+            --max-time 280 -X POST "$APP_URL/api/v1/internal/jobs/process" \
+            -H "Authorization: Bearer $CRON_SECRET"
         env:
           APP_URL: ${{ secrets.APP_URL }}
           CRON_SECRET: ${{ secrets.CRON_SECRET }}
       - name: Monitor tick
         run: |
-          curl -fsS -m 280 -X POST "$APP_URL/api/v1/internal/cron/tick" \
-            -H "Authorization: Bearer $CRON_SECRET" || echo "cron/tick failed (non-fatal)"
+          curl --fail-with-body --silent --show-error --retry 2 --retry-all-errors \
+            --max-time 280 -X POST "$APP_URL/api/v1/internal/cron/tick" \
+            -H "Authorization: Bearer $CRON_SECRET"
         env:
           APP_URL: ${{ secrets.APP_URL }}
           CRON_SECRET: ${{ secrets.CRON_SECRET }}

.gitignore

@@ -10,6 +10,7 @@ out/
 .env
 .env.local
 .env.*.local
+config/vercel-env-paste.template
 
 # debug
 npm-debug.log*
@@ -23,6 +24,7 @@ pnpm-debug.log*
 
 # supabase local
 .supabase/
+supabase/.temp/
 
 # playwright
 test-results/
@@ -33,6 +35,9 @@ blob-report/
 .DS_Store
 coverage/
 .vercel
+.cache/
+.local/
+.pnpm-home/
 
 # crash dumps
 *.stackdump
@@ -44,4 +49,4 @@ coverage/
 
 # scratch / MCP tooling dirs
 .playwright-mcp/
-mcps/
+mcps/

CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+All notable product changes are documented here. The project follows a pre-1.0, date-based release cadence.
+
+## Unreleased
+
+### Security
+
+- Moved application data access behind explicit server authorisation and removed direct browser table/RPC grants.
+- Added profile-role escalation defence, invoker-security views, rate limiting, replay protection, and redacted provider logs.
+- Removed a tracked deployment-value file and added current-tree secret scanning.
+
+### Reliability
+
+- Added bounded queue retries, real monitor/escalator dispatch, production build CI, and mobile browser smoke tests.
+
+### Experience
+
+- Simplified the worked example, made long letters progressive-disclosure, and improved mobile touch targets.
+
+## 0.1.0 - 2026-07-14
+
+- Public beta foundation: guided intake, evidence handling, case dashboard, draft ladder, proof gates,
+  monitoring, data export/erasure, English/Hindi UI, and private evidence storage.