release: promote Noosphere dev to main

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.github
+.env
+.env.*
+!.env.example
+node_modules
+apps/web/.next
+apps/crawler/.venv
+apps/crawler/.pytest_cache
+apps/crawler/__pycache__
+dist
+coverage
+.next
+prototype
+tests
+*.log
+.DS_Store

.env.example

@@ -2,22 +2,48 @@ DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/ignition_outbound
 OPENAI_API_KEY=
 OPENAI_RESEARCH_MODEL=
 OPENAI_SYNTHESIS_MODEL=
-OPENAI_EMBEDDING_MODEL=text-embedding-3-small
-AI_PROVIDER=kimi-code
+TEI_EMBEDDING_GRPC_ADDRESS=127.0.0.1:8081
+TEI_EMBEDDING_RUNTIME_MODEL_ID=janni-t/qwen3-embedding-0.6b-int8-tei-onnx
+TEI_EMBEDDING_RUNTIME_MODEL_SHA=8fe0c238c7c48016d28e750413ca492024be3ddf
+TEI_EMBEDDING_DIMENSION=1024
+TEI_EMBEDDING_CONCURRENCY=1
+TEI_RERANKER_GRPC_ADDRESS=127.0.0.1:8082
+TEI_RERANKER_RUNTIME_MODEL_ID=csylabs/bge-reranker-v2-m3-int8-onnx
+TEI_RERANKER_RUNTIME_MODEL_SHA=eaf5072d7b1a3f1fa584cc7482c7efb8f784dca0
+TEI_GRPC_TIMEOUT_MS=15000
+TEI_QUERY_INSTRUCTION=Given a search query, retrieve relevant passages that answer the query in French or English.
+AI_PROVIDER=codex-cli
 KIMI_CODE_API_KEY=
 KIMI_CODE_BASE_URL=https://api.kimi.com/coding/v1
-KIMI_RESEARCH_MODELS=kimi-for-coding,k3,kimi-for-coding-highspeed
-KIMI_SYNTHESIS_MODELS=kimi-for-coding,kimi-for-coding-highspeed,k3
+KIMI_RESEARCH_MODELS=k3,k3-256k
+PROSPECT_DECISION_MODEL=k3
+KIMI_SYNTHESIS_MODELS=k3-256k,k3
+KIMI_FALLBACK_MODELS=kimi-for-coding-highspeed
+# Use AI_PROVIDER=codex-cli for a Codex-only deployment. Authentication is
+# stored in the private codex-service-home Docker volume.
+CODEX_DEFAULT_MODEL=gpt-5.6-luna
+CODEX_DEFAULT_REASONING_EFFORT=xhigh
+CODEX_FALLBACK_MODELS=gpt-5.4-mini
+CODEX_BINARY_PATH=codex
 SEARXNG_URL=http://searxng:8080
 SEARXNG_SECRET=replace-with-a-random-internal-secret
 UNIPILE_DSN=https://api37.unipile.com:16796
 UNIPILE_API_KEY=
 UNIPILE_LINKEDIN_ACCOUNT_ID=
+UNIPILE_WHATSAPP_ACCOUNT_ID=
+UNIPILE_WEBHOOK_SECRET=
+UNIPILE_INBOX_SYNC_ENABLED=true
+UNIPILE_SOCIAL_CONTENT_SYNC_ENABLED=true
+UNIPILE_SOCIAL_ENGAGEMENT_SYNC_ENABLED=true
+CALENDAR_WEBHOOK_SIGNING_KEY=
+PUBLIC_WEBHOOK_BASE_URL=http://localhost:3001
+OUTBOUND_LINKEDIN_DAILY_LIMIT=20
+OUTBOUND_EMAIL_DAILY_LIMIT=50
+OUTBOUND_WHATSAPP_DAILY_LIMIT=30
+BOOKING_URL=
 CRAWLER_SERVICE_URL=http://127.0.0.1:8000
 CRAWLER_API_KEY=
 SEARCH_FALLBACK_ENABLED=true
-DOCLING_SERVICE_URL=http://127.0.0.1:5001
-DOCLING_API_KEY=
 S3_ENDPOINT=http://127.0.0.1:9000
 S3_REGION=us-east-1
 S3_BUCKET=ignition-outbound
@@ -35,6 +61,9 @@ BOOTSTRAP_WORKSPACE_SLUG=ignition-ai
 BOOTSTRAP_WORKSPACE_NAME=IgnitionAI
 PORT=3001
 WORKER_ID=research-worker-1
+DAILY_PROSPECTING_TIME=06:00
+DAILY_PROSPECTING_TIMEZONE=Europe/Paris
 JOB_LEASE_MS=60000
-JOB_BATCH_SIZE=1
+JOB_HEARTBEAT_MS=20000
+JOB_BATCH_SIZE=4
 JOB_POLL_INTERVAL_MS=1000

.github/workflows/check.yml

@@ -0,0 +1,125 @@
+name: Check
+
+on:
+  push:
+    branches:
+      - dev
+      - preprod
+      - prod
+  pull_request:
+    branches:
+      - dev
+      - preprod
+      - prod
+
+permissions:
+  contents: read
+
+env:
+  # CI-only values. They are intentionally non-secret and never used against
+  # external providers or production services.
+  DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/ignition_outbound_test
+  # Integration tests create/migrate their own database and must not share the
+  # database used by the repository migration check above.
+  TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/ignition_outbound_integration_test
+  OPENAI_API_KEY: ci-test-openai-key
+  OPENAI_RESEARCH_MODEL: ci-test-research-model
+  OPENAI_SYNTHESIS_MODEL: ci-test-synthesis-model
+  OPENAI_EMBEDDING_MODEL: text-embedding-3-small
+  AI_PROVIDER: openai
+  BETTER_AUTH_URL: http://localhost:3000
+  BETTER_AUTH_SECRET: ci-only-better-auth-secret-012345678901234567890123
+  BETTER_AUTH_TRUSTED_ORIGINS: http://localhost:3000,http://127.0.0.1:3000
+  BETTER_AUTH_ALLOW_SIGN_UP: "false"
+  OUTBOUND_API_URL: http://127.0.0.1:3001
+  S3_ENDPOINT: http://127.0.0.1:9000
+  S3_REGION: us-east-1
+  S3_BUCKET: ignition-outbound-ci
+  S3_ACCESS_KEY_ID: ci-access-key
+  S3_SECRET_ACCESS_KEY: ci-secret-key
+  DOCLING_SERVICE_URL: http://127.0.0.1:5001
+  CRAWLER_SERVICE_URL: http://127.0.0.1:8000
+  SEARCH_FALLBACK_ENABLED: "true"
+  PORT: "3001"
+  BOOTSTRAP_OWNER_EMAIL: noosphere-ci@example.test
+  BOOTSTRAP_OWNER_NAME: Noosphere CI
+  BOOTSTRAP_OWNER_PASSWORD: noosphere-ci-password
+  BOOTSTRAP_WORKSPACE_SLUG: ignition-ai
+  BOOTSTRAP_WORKSPACE_NAME: IgnitionAI
+
+jobs:
+  check:
+    name: bun run check
+    runs-on: ubuntu-latest
+    services:
+      database:
+        image: paradedb/paradedb:v0.23.5
+        env:
+          POSTGRES_DB: ignition_outbound_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d ignition_outbound_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.4
+
+      - name: Cache Bun
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: apps/crawler/uv.lock
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('apps/crawler/uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Install Playwright Chromium
+        working-directory: apps/crawler
+        run: uv run playwright install --with-deps chromium
+
+      - name: Apply database migrations
+        run: bun run db:migrate
+
+      - name: Run repository checks
+        run: bun run check
+
+      - name: Run PostgreSQL integration tests
+        run: bun run test:integration
+
+      - name: Install browser for Noosphere P0
+        run: bunx playwright install --with-deps chromium
+
+      - name: Run Noosphere browser journeys
+        run: bun run test:e2e

.github/workflows/ci.yml

@@ -1,39 +1,17 @@
-name: CI
+name: CI (legacy manual entrypoint)
 
+# The branch and pull-request automation lives in check.yml. Keep this file as
+# a manual escape hatch for links/bookmarks to the old CI workflow, without
+# running a second, incomplete check on every push.
 on:
-  push:
-  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  verify:
+  info:
     runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:17-alpine
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: ignition_outbound_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U postgres -d ignition_outbound_test"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.4
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-      - name: Verify repository
-        run: bun run check
-      - name: Verify PostgreSQL foundation
-        env:
-          TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/ignition_outbound_test
-        run: bun run test:integration
+      - name: Use the Check workflow
+        run: echo "Run the Check workflow for the supported dev -> preprod -> prod flow."

.gitignore

@@ -6,8 +6,25 @@ node_modules/
 .next/
 dist/
 coverage/
+playwright-report/
+test-results/
+__pycache__/
+.pytest_cache/
+.venv/
+*.py[cod]
 *.tsbuildinfo
 *.log
 .env
 .env.*
 !.env.example
+!deploy/.env.production.example
+
+# Python
+__pycache__/
+*.pyc
+
+# Agent tool dirs
+.aionrs/
+.claude/
+.codex/
+.kimi/

CONTRIBUTING.md

@@ -16,9 +16,32 @@ bun run check
 Lors de l’implémentation Next.js, ajouter progressivement types, tests
 unitaires, tests PostgreSQL, contrats fournisseurs et tests visuels.
 
+Les tests d’intégration PostgreSQL s’exécutent uniquement via
+`bun run test:integration` : le script dérive une base `_test` isolée et
+refuse `TEST_DATABASE_URL=DATABASE_URL`. Ne jamais lancer
+`bun test tests/integration` directement — sans `TEST_DATABASE_URL`, les
+tests retombent sur la base de développement et échouent sur ses résidus
+d’état.
+
+## Flux de branches
+
+Trois branches permanentes, promotion dans un seul sens :
+
+- `dev` : intégration. Tout le travail (features, fixes, docs) est commité ici,
+  directement ou via une branche `feat/<description>` fusionnée dans `dev` ;
+- `preprod` : validation. On y promeut `dev` quand `bun run check` est vert et
+  la QA passée (parcours réel API + base, états, responsive) ;
+- `prod` : production. On y promeut `preprod` uniquement pour une release
+  validée. `main` reflète `prod`.
+
+Règles : aucun commit direct sur `preprod`/`prod` hors promotion ; un correctif
+urgent part de `prod` en `fix/<description>` puis est fusionné dans `prod`,
+`preprod` et `dev`.
+
 ## Branches et commits
 
-- branche : `feat/<description>`, `fix/<description>` ou `docs/<description>` ;
+- branche de travail : `feat/<description>`, `fix/<description>` ou
+  `docs/<description>`, fusionnée dans `dev` ;
 - changements limités à un objectif ;
 - aucune donnée personnelle réelle dans les fixtures ;
 - aucune clé fournisseur dans le dépôt.