Sync main fixes into redesign API for #746

.github/workflows/arch-map.yml

@@ -22,5 +22,11 @@ jobs:
           node-version: 22
       - name: Regenerate architecture map
         run: node tools/arch-map.mjs
-      - name: Fail on drift
-        run: git diff --exit-code architecture.json architecture.html
+      - name: Publish architecture map
+        uses: actions/upload-artifact@v7
+        with:
+          name: architecture-map
+          path: |
+            architecture.json
+            architecture.html
+          if-no-files-found: error

.github/workflows/dependency-review.yml

@@ -12,6 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/gating-matrix.yml

@@ -43,7 +43,7 @@ jobs:
           fi
 
       - name: Publish the gating matrix
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: gating-matrix
           path: gating-matrix.json

.github/workflows/pullfrog.yml

@@ -49,32 +49,24 @@ jobs:
       # VERTEX_LOCATION: global
       # VERTEX_MODEL_ID: <vertex-model-id>
 
-      # for any OpenAI-compatible endpoint - LiteLLM, Cloudflare AI Gateway,
-      # self-hosted vLLM (https://docs.pullfrog.com/openai-compatible)
-      # OPENAI_COMPATIBLE_BASE_URL: https://litellm.example.com/v1
-      # OPENAI_COMPATIBLE_API_KEY: ${{ secrets.OPENAI_COMPATIBLE_API_KEY }}
-      # OPENAI_COMPATIBLE_MODEL: <model-id>
-      # both limits are required - set them to the real limits of that model
-      # OPENAI_COMPATIBLE_CONTEXT: "128000"
-      # OPENAI_COMPATIBLE_MAX_OUTPUT: "16384"
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
           fetch-depth: 1
-      # Codex is the reviewer. No model input, so Pullfrog resolves its own
-      # default exactly as before.
+      # Model and effort come from the Pullfrog repository config.
+      # Both steps pin the same commit because a moving tag is an unpinned dependency.
       - name: Run agent
         id: codex
-        uses: pullfrog/pullfrog@v0
+        uses: pullfrog/pullfrog@e9f81154ce83828fc8208d624c5ca9a1174d8909 # v0, release 0.1.83
         continue-on-error: true
         with:
           prompt: ${{ inputs.prompt }}
       # Claude reviews ONLY when the Codex step fails, which is what an
       # exhausted OpenAI allowance looks like. Green runs never reach this.
       - name: Run agent (Claude fallback)
         if: steps.codex.outcome == 'failure'
-        uses: pullfrog/pullfrog@v0
+        uses: pullfrog/pullfrog@e9f81154ce83828fc8208d624c5ca9a1174d8909 # v0, release 0.1.83
         with:
           prompt: ${{ inputs.prompt }}
           model: anthropic/claude-opus-5

.github/workflows/sonarcloud.yml

@@ -14,6 +14,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.gitignore

@@ -63,3 +63,7 @@ caddy_config/
 
 ## Generated gating matrix
 /gating-matrix.json
+
+## Generated architecture map
+/architecture.json
+/architecture.html

AGENTS.md

@@ -4,6 +4,9 @@ Instructions for Codex CLI workers. Claude Code reads CLAUDE.md; this file holds
 worker contract and DEFERS to `CLAUDE.md` (same directory) for repo conventions. Read
 CLAUDE.md before writing code.
 
+Run `node tools/arch-map.mjs` before reading `architecture.json` or `architecture.html`.
+Both files are generated locally and are not committed.
+
 Pullfrog reviews every pull request from GitHub Actions. Its review instructions live in
 the Pullfrog console, never in a repository file, because a pull request can edit any
 file on its own head. Nothing here configures that review.

CLAUDE.md

@@ -10,6 +10,8 @@
 
 Clean architecture, four projects: `Orbit.Api` → `Orbit.Application` → `Orbit.Domain` ← `Orbit.Infrastructure`. CQRS via MediatR. Commands and queries live per-feature folder in `Orbit.Application`. Domain entities use factory methods (`Habit.Create()`, `User.Create()`). Generic repository + Unit of Work in Infrastructure. Each project has a scoped `CLAUDE.md` — read those when editing inside that project.
 
+Run `node tools/arch-map.mjs` before reading `architecture.json` or `architecture.html`. Both maps are generated locally and are not committed. The `arch-map` workflow runs the generator and publishes both maps as an artifact.
+
 ## Cross-cutting hard rules
 
 These apply everywhere — they override project-local conventions if they conflict.