Release v1.0.2

.dockerignore

@@ -0,0 +1,20 @@
+# Secrets and local configuration
+.env*
+!.env.example
+
+# Dependencies and generated output
+node_modules
+.next
+out
+build
+coverage
+
+# Repository and agent tooling
+.git
+.github
+.worktrees
+.codegraph
+
+# Local artifacts
+tmp
+*.log

.env.example

@@ -17,22 +17,65 @@ JINA_API_KEY=
 TINYFISH_API_KEY=
 SCRAPER_TIMEOUT_MS=8000
 SCRAPER_MAX_RESPONSE_BYTES=1048576
-SCRAPER_MAX_REDIRECTS=3
 MAX_SCRAPE_PAGES_PER_RESEARCH=5
 
+# Crawl Policy & News Extraction
+CRAWL_USER_AGENT=PartnerIQBot
+CRAWL_MIN_DOMAIN_INTERVAL_MS=1000
+ROBOTS_CACHE_TTL_MS=86400000
+ROBOTS_FAIL_MODE=metadata_only
+NEWS_ARTICLE_EXTRACTION_ENABLED=true
+
+
 # Registry
 VIETQR_ENABLED=true
 
 # Storage
 STORAGE_PROVIDER=supabase        # supabase | memory
 SUPABASE_URL=https://xyz.supabase.co
-SUPABASE_ANON_KEY=...
+SUPABASE_SERVICE_ROLE_KEY=server-only-secret
+# Browser Supabase Auth (publishable values; safe to expose to the client bundle)
+NEXT_PUBLIC_SUPABASE_URL=https://xyz.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=public-anon-or-publishable-key
+
+# Required when Langfuse telemetry is enabled; never use a public/default value.
+LANGFUSE_SALT=server-only-telemetry-secret
+
+# Research gateway (Cloudflare Worker + signed Cloud Run origin)
+# Set real staging/production values in workers/research-gateway/wrangler.jsonc.
+RESEARCH_GATEWAY_URL=https://research-gateway.example.workers.dev
+ORIGIN_URL=https://partneriq-origin.example.run.app
+SUPABASE_JWT_ISSUER=https://xyz.supabase.co/auth/v1
+SUPABASE_JWT_AUDIENCE=authenticated
+SUPABASE_TENANT_CLAIM=tenant_id
+SUPABASE_MEMBERSHIP_RPC=resolve_research_tenant
+SUPABASE_QUOTA_RPC=reserve_research_quota
+GATEWAY_KEY_ID=current
+REPLAY_WINDOW_SECONDS=60
+# Worker secrets: configure per environment with Wrangler; leave empty here.
+SUPABASE_API_KEY=
+GATEWAY_SIGNING_KEY=
+# Node origin secrets: current plus optional previous key during rotation.
+GATEWAY_SIGNING_KEY_CURRENT=
+GATEWAY_SIGNING_KEY_PREVIOUS=
 
 # Rate limit guards (optional overrides)
 MAX_CONCURRENT_RESEARCH=1
+MAX_QUERIES_PER_RESEARCH=6
+MAX_CONCURRENT_SOURCE_NODES=3
+MAX_CONCURRENT_PROVIDER_CALLS=2
 SOURCE_TIMEOUT_MS=60000
 MAX_RESEARCH_PER_DAY=50
 MAX_TOKENS_PER_DAY=500000
 
+# Observability — Langfuse Cloud
+LANGFUSE_ENABLED=false
+LANGFUSE_PUBLIC_KEY=pk-lf-...
+LANGFUSE_SECRET_KEY=sk-lf-...
+LANGFUSE_BASE_URL=https://cloud.langfuse.com
+LANGFUSE_TRACING_ENVIRONMENT=production
+LANGFUSE_LOG_LEVEL=WARN
+
 # App
 NODE_ENV=development
+

.github/workflows/ci.yml

@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   checks:
+    timeout-minutes: 20
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -25,6 +26,25 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Detect research gateway Worker
+        id: worker
+        shell: bash
+        run: |
+          if [[ -f workers/research-gateway/package.json ]]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install Worker dependencies
+        if: steps.worker.outputs.enabled == 'true'
+        working-directory: workers/research-gateway
+        run: npm ci --omit=optional
+
+      - name: Check Worker
+        if: steps.worker.outputs.enabled == 'true'
+        run: npm run worker:check
+
       - name: Type check
         run: npm run typecheck
 
@@ -34,5 +54,16 @@ jobs:
       - name: Test
         run: npm test
 
+      - name: Database integration tests
+        run: |
+          npx supabase start
+          eval "$(npx supabase status -o env)"
+          SUPABASE_TEST_URL="$API_URL" SUPABASE_TEST_SERVICE_ROLE_KEY="$SERVICE_ROLE_KEY" SUPABASE_TEST_ANON_KEY="$ANON_KEY" npm run test:db
+
+      - name: Stop Supabase
+        if: always()
+        run: npx supabase stop --no-backup
+
       - name: Build
         run: npm run build
+

.github/workflows/deploy-worker-production.yml

@@ -0,0 +1,59 @@
+name: Deploy research gateway (production)
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tested commit SHA to deploy
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-research-gateway-production
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment: production
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout requested commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Require an exact commit SHA
+        env:
+          DEPLOY_REF: ${{ inputs.ref }}
+        run: |
+          if [[ ! "$DEPLOY_REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "Production deployments require a full 40-character commit SHA." >&2
+            exit 1
+          fi
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: workers/research-gateway/package-lock.json
+
+      - name: Install Worker dependencies
+        working-directory: workers/research-gateway
+        run: npm ci --omit=optional
+
+      - name: Check Worker
+        run: npm run worker:check
+
+      - name: Validate deployment configuration
+        run: npm --prefix workers/research-gateway run predeploy
+
+      - name: Deploy production Worker
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        working-directory: workers/research-gateway
+        run: npm exec -- wrangler deploy --env production

.github/workflows/deploy-worker-staging.yml

@@ -0,0 +1,51 @@
+name: Deploy research gateway (staging)
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref or commit SHA to deploy
+        required: true
+        default: main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-research-gateway-staging
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment: staging
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout requested ref
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: workers/research-gateway/package-lock.json
+
+      - name: Install Worker dependencies
+        working-directory: workers/research-gateway
+        run: npm ci --omit=optional
+
+      - name: Check Worker
+        run: npm run worker:check
+
+      - name: Validate deployment configuration
+        run: npm --prefix workers/research-gateway run predeploy
+
+      - name: Deploy staging Worker
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        working-directory: workers/research-gateway
+        run: npm exec -- wrangler deploy --env staging

.github/workflows/release.yml

@@ -16,6 +16,7 @@ concurrency:
 
 jobs:
   publish:
+    timeout-minutes: 20
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push'

.gitignore

@@ -50,3 +50,4 @@ next-env.d.ts
 
 # temp fixtures
 /tmp/
+supabase/.temp/

AGENTS.md

@@ -200,7 +200,7 @@ Prefer single-file or single-test runs during iteration. Full suites are for the
 
 When the user corrects your approach, append a one-line rule here before ending the session. Write it concretely ("Always use X for Y"), never abstractly ("be careful with Y"). If an existing line already covers the correction, tighten it instead of adding a new one. Remove lines when the underlying issue goes away (model upgrades, refactors, process changes).
 
-- (empty)
+- For external-content previews, separate source-quality signals from claim verification; default to metadata plus a short excerpt, respect paywalls and publisher controls, and treat jurisdiction-specific copyright review as a release requirement.
 
 ---
 
@@ -214,4 +214,4 @@ This boilerplate synthesizes:
 - Community anti-sycophancy patterns (explicit banned phrases, direct-not-diplomatic).
 - The AGENTS.md open standard (cross-tool portability via symlinks).
 
-Read once. Edit sections 10 and 11 for your project. Prune the rest over time. This file gets better the more you use it.
+Read once. Edit sections 10 and 11 for your project. Prune the rest over time. This file gets better the more you use it.

Dockerfile

@@ -2,7 +2,7 @@
 # Dockerfile — PartnerIQ (Google Cloud Run / Production)
 # ═══════════════════════════════════════════════════════
 
-FROM node:20-alpine AS base
+FROM node:22-alpine AS base
 
 # Step 1: Install dependencies
 FROM base AS deps