- scripts/screenshots.py + scripts/Dockerfile.shots: playwright-in-compose
runner, 7 demo shots against the seeded stack (DinD-safe, output volume)
- docker-compose.yml: api + web services (nginx SPA + /api proxy-less via
build-arg VITE_API_BASE), shots service with volume output
- apps/api: add CORSMiddleware (SPA origin web:80 could not read api:8000),
batch scoring now refuses to rewrite applications beyond
discovered/scored (kanban page load previously reset sent/interviewing
to scored), prompt-aware cv_tailor mock so demo passes hallucination
guard, hallucination-guard tests repointed to monkeypatched run_task
- apps/web: Applications kanban batches only unscored applications, red
flag display falls back to stored rationale
- 159 api tests + 14 web tests green after fixes
- apps/api: psycopg v3 repositories, schema.sql + migration runner, state machine
implementing the data-model transition table, approval gate with sha256 hash
match + 24h expiry enforced at send time, EchoTransport pluggable sender,
LLM calls routed through packages.llm-gateway with mock mode, 47 pytest tests green
- apps/api/Dockerfile.test: python 3.13-slim test image (DinD-safe: migrations
copied as directory)
- docker-compose.yml: add api-test service on compose network (host port
publishing is broken in this sandbox; container-to-container networking used)
- Fix: replace masked placeholder password in config.py/conftest.py defaults