docs: align setup and supported workflows with current contracts

README.md

@@ -13,15 +13,15 @@
   ·
   <a href="CONTRIBUTING.md">Contributing</a>
   ·
-  <a href="https://discord.gg/qvk9DcxDA">Discord</a>
+  <a href="https://github.com/Second-Origin/PARTHA/issues">Support</a>
 </p>
 
 <p align="center">
   <a href="https://github.com/Second-Origin/PARTHA/releases/latest"><img alt="Latest release" src="https://img.shields.io/github/v/release/Second-Origin/PARTHA?label=release"></a>
   <img alt="Apache 2.0 license" src="https://img.shields.io/github/license/Second-Origin/PARTHA">
   <img alt="Python 3.12–3.13" src="https://img.shields.io/badge/Python-3.12--3.13-3776AB?logo=python&logoColor=white">
   <img alt="Node.js 22" src="https://img.shields.io/badge/Node.js-22-5FA04E?logo=nodedotjs&logoColor=white">
-  <a href="https://discord.gg/qvk9DcxDA"><img alt="Discord" src="https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white"></a>
+  <a href="https://github.com/Second-Origin/PARTHA/issues"><img alt="Support" src="https://img.shields.io/badge/Support-Issues-5865F2?logo=github&logoColor=white"></a>
 </p>
 
 **PARTHA turns one repository revision into a sealed, queryable intelligence model, and serves architecture, dependencies, engineering review, insights, documentation, and AI context from that one model.**
@@ -157,7 +157,7 @@ Supported structural facts retain evidence and provenance back to their reposito
 | Tool | Version | Needed for |
 | --- | --- | --- |
 | Python | 3.12 or 3.13 | Backend |
-| Node.js | 22 | Frontend and workflow scripts |
+| Node.js | 22.22.2+ in the 22.x line | Frontend and workflow scripts |
 | Git | recent | Checkout and public GitHub import |
 
 Development uses SQLite, an in-memory rate limiter, and local filesystem storage. No container runtime or external database is required, and no `.env` file is needed.
@@ -168,15 +168,28 @@ cd PARTHA
 
 # 1. Backend — http://localhost:8000  (OpenAPI at /docs, readiness at /ready)
 cd apps/backend
-python3.13 -m venv .venv && source .venv/bin/activate
+python3.13 -m venv .venv
+source .venv/bin/activate
 pip install -e .
-cd ../.. && npm run dev:backend
+cd ../..
+npm run dev:backend
 
 # 2. Frontend — http://localhost:5173  (second terminal)
 npm ci --prefix apps/frontend
 npm run dev:frontend
 ```
 
+On Windows PowerShell, use the same checkout and frontend commands, with this backend setup in the first terminal:
+
+```powershell
+cd apps/backend
+py -3.13 -m venv .venv
+.\.venv\Scripts\python.exe -m pip install -e .
+.\.venv\Scripts\python.exe -m uvicorn app.main:app --reload --port 8000
+```
+
+Python 3.12 is also supported (`python3.12` or `py -3.12`). The Node minimum reflects the locked test tooling, including jsdom.
+
 Open `http://localhost:5173`, register a local account, add a repository, and start analysis.
 
 ### Or run it with Docker
@@ -189,7 +202,7 @@ cd PARTHA
 docker compose up --build
 ```
 
-Open `http://localhost:8000`. The first account you register becomes the owner of the instance; approve anyone else with `docker compose exec partha python scripts/approve_email.py --email them@example.com`. Data and generated secrets live in the `partha-data` volume, and the port is bound to `127.0.0.1` only. See [`docker-compose.yml`](docker-compose.yml) for the details.
+Open `http://localhost:8000`. Initial setup permits the first account without prior approval; this grants no administrator role. Approve later emails with `docker compose exec partha python scripts/approve_email.py --email them@example.com`. Data and generated secrets live in the `partha-data` volume, and the port is bound to `127.0.0.1` only. See [`docker-compose.yml`](docker-compose.yml) for the details.
 
 The [development guide](docs/DEVELOPMENT.md) covers the full test / lint / build / benchmark / Docker / E2E commands and the local database and API-contract failures you are most likely to hit. Review the [AI provider egress policy](docs/security/AI_PROVIDER_EGRESS.md) before configuring any custom or local provider endpoint.
 
@@ -201,7 +214,7 @@ The [development guide](docs/DEVELOPMENT.md) covers the full test / lint / build
 - **Whole-repository analysis.** Every analysis re-reads the whole repository. There is no incremental re-analysis.
 - **No cross-revision comparison.** Lineage preserves revision history; it does not diff two snapshots, detect renames or moves, or compute a historical blast radius. Change-impact analysis is single-snapshot structural traversal only.
 - **Optional AI can be external.** Depending on configuration, AI calls a configured provider; only local providers keep everything on the host. See the [egress policy](docs/security/AI_PROVIDER_EGRESS.md).
-- **In-process worker.** One daemon worker thread inside the API process handles one analysis job at a time; there is no separate worker service or job queue.
+- **In-process worker.** One daemon worker thread inside the API process handles one analysis job at a time; a durable DB-backed `analysis_jobs` queue stores work, leases, retries and cancellation. There is no separate worker service.
 
 Non-auth product routes require authentication, repository access is owner-scoped, provider keys are Fernet-encrypted at rest, and AI egress is validated against a deployment-owned allowlist with DNS pinning — meaningful controls, but not a claim of production hardening. Registration does not verify email ownership, and in the default `development` environment any address may register. See [SECURITY.md](SECURITY.md) and [`docs/CAPABILITIES.md`](docs/CAPABILITIES.md) for the details.
 
@@ -221,7 +234,7 @@ Issues and pull requests are welcome. Start with [CONTRIBUTING.md](CONTRIBUTING.
 
 ## Community
 
-- [Discord](https://discord.gg/qvk9DcxDA) — questions, progress, and discussion with maintainers
+- [GitHub support issues](https://github.com/Second-Origin/PARTHA/issues) — questions, progress, and discussion with maintainers
 - [Issues](https://github.com/Second-Origin/PARTHA/issues) — bugs and feature requests
 
 ## Releases

apps/backend/app/extraction/support_matrix.py

@@ -747,7 +747,7 @@ def _product_capability(
         "repository-lineage",
         SupportStatus.PARTIAL,
         "Durable lineage grouping repeated imports of the same repository (RFC-0002).",
-        "The `repository_lineages` table, owner-scoped grouping, and duplicate-revision detection run on every import; `GET /repositories/{id}/lineage` and the repository detail page expose the ordered history. Refresh and cross-revision comparison on top of a lineage are not built.",
+        "The `repository_lineages` table, owner-scoped grouping, and duplicate-revision detection run on every import; `GET /repositories/{id}/lineage` and the repository detail page expose the ordered history. GitHub branch re-analysis refreshes the remote branch head and retains a new revision in the lineage when it changes. Whole-repository analysis is rerun; cross-revision comparison is not built.",
     ),
     _product_capability(
         "service-interactions",
@@ -873,7 +873,7 @@ def _code_list(items: tuple[str, ...]) -> str:
         "repository-lineage",
         "Repository lineage",
         PublicStatus.IMPLEMENTED_WITH_DISCLOSED_LIMITS,
-        "Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with duplicate-revision detection (RFC-0002). `GET /repositories/{id}/lineage` returns the ordered history and the repository detail page renders it. Refresh and cross-revision comparison on top of a lineage are not built.",
+        "Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with duplicate-revision detection (RFC-0002). `GET /repositories/{id}/lineage` returns the ordered history and the repository detail page renders it. GitHub branch re-analysis refreshes the remote branch head and retains a new revision in the lineage when it changes. Whole-repository analysis is rerun; cross-revision comparison is not built.",
         ("product.repository-lineage",),
     ),
     PublicCapability(

apps/frontend/src/features/landing/components/StoryCard.tsx

@@ -316,6 +316,7 @@ export function StoryCard({ className }: { className?: string }) {
       onFocusCapture={hold}
       onBlurCapture={release}
     >
+      <p className="absolute bottom-3 left-10 right-10 z-10 text-center text-xs text-muted-foreground">Illustrative architecture; framework labels are not a semantic support claim.</p>
       <div className="absolute inset-0 rounded-[110px] bg-[var(--story-surface)]" />
 
       {VARIANTS.map((variant, i) => (

apps/frontend/src/features/landing/faq.ts

@@ -23,8 +23,8 @@ export const faqAnswers = [
   'No. PARTHA is a deterministic extractor. There is no model that hallucinates and no temperature parameter. The same repo at the same revision produces a byte-identical ri.v1 artifact.',
   'They\u2019re flagged, not guessed. Each unresolved call site has a confidence field and provenance. You see exactly what PARTHA could and could not statically resolve.',
   // Not yet exported from the design; PARTHA wording, pending the real copy.
-  'Language support is determined by the extractors available for the selected repository. The sealed snapshot records exactly what was assessed.',
-  'PARTHA analyses a repository at a specific revision and retains a reproducible model for the workspace.',
-  'Connect a repository, select a revision, then use the generated evidence and exports in the engineering workflow that suits your team.',
+  'Python and TypeScript/JavaScript have the strongest semantic extraction. Other languages contribute file inventory; supported manifests and lockfiles contribute dependency declarations. The snapshot reports assessment limits.',
+  'Run PARTHA locally or self-host it in a trusted environment. The public website is a scripted demonstration; repository analysis runs on your installation.',
+  'CI integration is manual: run your installation and use authenticated APIs or exported evidence in your own workflow. PARTHA does not install a hosted CI app or provide automated pull-request review.',
   'ri.v1 is PARTHA\u2019s sealed repository-intelligence snapshot format. It records the exact revision, extracted facts, and available evidence.',
 ] as const;

apps/marketing/src/components/landing/StoryCard.tsx

@@ -316,6 +316,7 @@ export function StoryCard({ className }: { className?: string }) {
       onFocusCapture={hold}
       onBlurCapture={release}
     >
+      <p className="absolute bottom-3 left-10 right-10 z-10 text-center text-xs text-muted-foreground">Illustrative architecture; framework labels are not a semantic support claim.</p>
       <div className="absolute inset-0 rounded-[110px] bg-[var(--story-surface)]" />
 
       {VARIANTS.map((variant, i) => (

apps/marketing/src/data/faq.ts

@@ -23,8 +23,8 @@ export const faqAnswers = [
   'No. PARTHA is a deterministic extractor. There is no model that hallucinates and no temperature parameter. The same repo at the same revision produces a byte-identical ri.v1 artifact.',
   'They\u2019re flagged, not guessed. Each unresolved call site has a confidence field and provenance. You see exactly what PARTHA could and could not statically resolve.',
   // Not yet exported from the design; PARTHA wording, pending the real copy.
-  'Language support is determined by the extractors available for the selected repository. The sealed snapshot records exactly what was assessed.',
-  'PARTHA analyses a repository at a specific revision and retains a reproducible model for the workspace.',
-  'Connect a repository, select a revision, then use the generated evidence and exports in the engineering workflow that suits your team.',
+  'Python and TypeScript/JavaScript have the strongest semantic extraction. Other languages contribute file inventory; supported manifests and lockfiles contribute dependency declarations. The snapshot reports assessment limits.',
+  'Run PARTHA locally or self-host it in a trusted environment. The public website is a scripted demonstration; repository analysis runs on your installation.',
+  'CI integration is manual: run your installation and use authenticated APIs or exported evidence in your own workflow. PARTHA does not install a hosted CI app or provide automated pull-request review.',
   'ri.v1 is PARTHA\u2019s sealed repository-intelligence snapshot format. It records the exact revision, extracted facts, and available evidence.',
 ] as const;

apps/marketing/src/data/site.ts

@@ -5,7 +5,7 @@
 
 export const GITHUB_URL = 'https://github.com/Second-Origin/PARTHA';
 const REPO_BLOB = `${GITHUB_URL}/blob/dev`;
-export const DISCORD_URL = 'https://discord.gg/qvk9DcxDA';
+export const SUPPORT_URL = `${GITHUB_URL}/issues`;
 export const LINKEDIN_URL = 'https://www.linkedin.com/in/parthrohit';
 
 export type FooterLink = {
@@ -43,15 +43,15 @@ export const FOOTER_COLUMNS: { heading: string; links: FooterLink[] }[] = [
     links: [
       { label: 'About', href: `${REPO_BLOB}/README.md`, external: true },
       { label: 'Security', href: `${REPO_BLOB}/SECURITY.md`, external: true },
-      { label: 'Contact', href: DISCORD_URL, external: true },
+      { label: 'Contact', href: SUPPORT_URL, external: true },
       { label: 'Legal', href: `${REPO_BLOB}/LICENSE`, external: true },
     ],
   },
   {
     heading: 'Connect',
     links: [
       { label: 'LinkedIn', href: LINKEDIN_URL, external: true },
-      { label: 'X', href: DISCORD_URL, external: true },
+      { label: 'Support', href: SUPPORT_URL, external: true },
       { label: 'GitHub', href: GITHUB_URL, external: true },
     ],
   },

docs/CAPABILITIES.md

@@ -34,7 +34,7 @@ release; `dev` carries active development.
 | Authentication and owner isolation | **Implemented** | Email/password, Argon2, short-lived access tokens, rotating refresh tokens with reuse detection. Google and GitHub OAuth sign-in and account linking are implemented but inert until provider credentials are configured, and never create an account. Registration is gated by an admin-managed email allowlist in every environment except `development` (the default when running from source), where any address may register, and except the first account on an empty instance, which becomes its owner. Registration does not verify email ownership, so an approved address can be claimed by whoever registers it first; there is no admin role or in-app approval. Protected resources are owner-scoped; non-owner access returns 404. |
 | Analysis lifecycle | **Implemented** | Database-backed, cancellable job with progress, bounded retry, lease renewal, and stale-worker recovery. |
 | Repository Intelligence | **Implemented with disclosed limits** | Immutable, revision-addressed `ri.v1` snapshots with normalized facts, evidence, query APIs, and a total canonical graph hash. Semantic extraction is strongest for supported Python and TypeScript/JavaScript constructs. |
-| Repository lineage | **Implemented with disclosed limits** | Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with duplicate-revision detection (RFC-0002). `GET /repositories/{id}/lineage` returns the ordered history and the repository detail page renders it. Refresh and cross-revision comparison on top of a lineage are not built. |
+| Repository lineage | **Implemented with disclosed limits** | Repeated imports of the same repository and branch are grouped into a durable, owner-scoped lineage with duplicate-revision detection (RFC-0002). `GET /repositories/{id}/lineage` returns the ordered history and the repository detail page renders it. GitHub branch re-analysis refreshes the remote branch head and retains a new revision in the lineage when it changes. Whole-repository analysis is rerun; cross-revision comparison is not built. |
 | Architecture and authentication explanation | **Implemented with disclosed limits** | Interactive snapshot-backed graph. Module/layer classification is heuristic. The cited authentication subgraph covers supported Python/FastAPI patterns only. |
 | Dependency Graph | **Implemented with disclosed limits** | Direct declarations from `package.json`, `pyproject.toml`, and `requirements.txt` plus resolved pins from `package-lock.json` and `poetry.lock`, merged onto one dependency identity with repeated workspace declarations and exact spans. A lockfile pin is recorded as a resolution, never as a direct dependency edge, so transitive resolution is still not claimed. |
 | Service-interaction discovery | **Implemented with disclosed limits** | Outbound HTTP call sites on `requests`, `httpx`, `fetch`, and `axios` resolve to a service node identified by its absolute origin, with the literal method and path on the call's own observation. A computed, relative, or shadowed destination is a diagnostic, never an edge. |

docs/DEVELOPMENT.md

@@ -22,7 +22,7 @@ processes, described below. To *use* PARTHA rather than work on it, the root
 [`Dockerfile`](../Dockerfile) (the built frontend served by the same FastAPI
 process) with SQLite and storage in a volume: `docker compose up --build`, then
 `http://localhost:8000`. It runs with `APP_ENV=production`, so the first
-account registered becomes the owner and later ones need
+account registered is permitted without prior approval, receives no administrator role, and later ones need
 `docker compose exec partha python scripts/approve_email.py --email ...`.
 
 ## 1. Clone and start the backend
@@ -61,7 +61,7 @@ npm run dev:frontend
 Open `http://localhost:5173`. There is no seeded account or sample
 repository (and no pre-approved email address) — register a new local account through the UI
 (in the default `APP_ENV=development` any address is accepted; anywhere else the first account
-on an empty instance becomes its owner and every later one must be added with
+on an empty instance is permitted without prior approval and every later email must be added with
 `apps/backend/scripts/approve_email.py`), then add a
 repository (upload an archive or import a public GitHub repository over
 HTTPS) and start analysis.