feat: repository integrity and end-to-end baseline (A–F)

.github/workflows/ci.yml

@@ -0,0 +1,91 @@
+name: CI — Clean-Clone Baseline
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+jobs:
+  # ── Job 1: Enforce no tracked generated artifacts ─────────────────────
+  repo-integrity:
+    name: Repository Integrity (no tracked artifacts)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check for tracked generated artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          FAIL=0
+          PATTERNS=("bin" "obj" "out" "dist" "TestResults" "coverage" "node_modules" ".next")
+          for pattern in "${PATTERNS[@]}"; do
+            matches=$(git ls-files -- "$pattern" 2>/dev/null || true)
+            if [[ -n "$matches" ]]; then
+              echo "::error::Tracked generated files under '${pattern}/':${matches}"
+              FAIL=1
+            fi
+          done
+          if [[ "$FAIL" -eq 1 ]]; then
+            echo ""
+            echo "One or more generated artifact directories are tracked in git."
+            echo "Remove them with: git rm -r --cached <path>"
+            echo "Then add the paths to .gitignore."
+            exit 1
+          fi
+          echo "No tracked generated artifacts found."
+
+  # ── Job 2: Full validate-premerge (build + conditional compose) ────────
+  validate-baseline:
+    name: Validate Pre-merge Baseline
+    runs-on: ubuntu-latest
+    needs: repo-integrity
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create .env from example (when present)
+        shell: bash
+        run: |
+          if [[ -f ".env.example" ]]; then
+            cp .env.example .env
+            echo ".env created from .env.example"
+          else
+            echo "No .env.example found — skipping"
+          fi
+
+      - name: Set up Java (for Kotlin/JAR toolchain)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Install Kotlin compiler
+        shell: bash
+        run: |
+          # Install Kotlin via SDKMAN or direct download
+          KOTLIN_VERSION="2.0.0"
+          curl -fsSL "https://github.com/JetBrains/kotlin/releases/download/v${KOTLIN_VERSION}/kotlin-compiler-${KOTLIN_VERSION}.zip" \
+            -o /tmp/kotlin.zip
+          unzip -q /tmp/kotlin.zip -d /tmp/kotlin
+          echo "/tmp/kotlin/kotlinc/bin" >> "$GITHUB_PATH"
+
+      - name: Run validate-premerge.sh
+        shell: bash
+        run: bash scripts/validate-premerge.sh --skip-compose
+
+      - name: Upload logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: validate-premerge-logs
+          path: |
+            **/out/
+            **/*.log
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/repo-integrity.yml

@@ -0,0 +1,74 @@
+name: Repository Integrity
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+jobs:
+  no-generated-artifacts:
+    name: No Tracked Generated Artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Enforce clean repository (no bin/obj/out/dist/…)
+        shell: bash
+        run: |
+          set -euo pipefail
+          FAIL=0
+
+          # Directories that must never be tracked
+          PATTERNS=(
+            "bin"
+            "obj"
+            "out"
+            "dist"
+            "TestResults"
+            "coverage"
+            "node_modules"
+            ".next"
+            ".nuxt"
+          )
+
+          for pattern in "${PATTERNS[@]}"; do
+            matches=$(git ls-files -- "$pattern" 2>/dev/null || true)
+            if [[ -n "$matches" ]]; then
+              echo "::error title=Tracked generated artifact::Files under '${pattern}/' are tracked in git:"
+              echo "$matches" | while IFS= read -r line; do
+                echo "  • $line"
+              done
+              FAIL=1
+            fi
+          done
+
+          # Also check for .pdb, .suo, .user files anywhere
+          EXTENSIONS=("*.pdb" "*.suo" "*.user")
+          for ext in "${EXTENSIONS[@]}"; do
+            matches=$(git ls-files -- "$ext" 2>/dev/null || true)
+            if [[ -n "$matches" ]]; then
+              echo "::error title=Tracked IDE/debug file::Files matching '${ext}' are tracked in git:"
+              echo "$matches" | while IFS= read -r line; do
+                echo "  • $line"
+              done
+              FAIL=1
+            fi
+          done
+
+          if [[ "$FAIL" -eq 1 ]]; then
+            echo ""
+            echo "──────────────────────────────────────────────────────────────"
+            echo " Repository Integrity FAILED"
+            echo " Remove tracked artifacts with:"
+            echo "   git rm -r --cached <path>"
+            echo " Then add the path to .gitignore and commit."
+            echo "──────────────────────────────────────────────────────────────"
+            exit 1
+          fi
+
+          echo "Repository integrity check PASSED — no generated artifacts tracked."

.gitignore

@@ -0,0 +1,57 @@
+# ============================================================
+# Acing IU: Genesis — root .gitignore
+# Keep generated artifacts, credentials, and IDE state out of
+# version control.  Update this file when new toolchains are
+# added rather than adding ad-hoc ignores elsewhere.
+# ============================================================
+
+# ── Build outputs ───────────────────────────────────────────
+**/bin/
+**/obj/
+**/out/
+**/dist/
+**/build/out/
+
+# ── Test and coverage results ────────────────────────────────
+**/TestResults/
+**/coverage/
+**/test-results/
+**/reports/
+
+# ── Frontend / Node ──────────────────────────────────────────
+**/node_modules/
+**/.next/
+**/.nuxt/
+**/.output/
+
+# ── Debug symbols and user files ────────────────────────────
+*.pdb
+*.user
+*.suo
+*.DS_Store
+Thumbs.db
+
+# ── Environment / secrets ────────────────────────────────────
+.env
+.env.*
+!.env.example
+local.properties
+
+# ── IDE state (IntelliJ / Android Studio) ───────────────────
+# We commit .idea/ project-level config selectively below;
+# volatile IDE caches and workspace state are excluded.
+.idea/caches/
+.idea/workspace.xml
+.idea/shelf/
+.idea/httpRequests/
+.idea/dataSources/
+.idea/dataSources.local.xml
+*.iml
+
+# ── OS artefacts ─────────────────────────────────────────────
+.DS_Store
+ehthumbs.db
+
+# ── Logs ─────────────────────────────────────────────────────
+*.log
+logs/