feat: harden Ellie for production readiness

.dockerignore

@@ -0,0 +1,14 @@
+node_modules
+.pnpm-store
+dist
+build
+coverage
+.vite
+.env
+.env.*
+!.env.example
+.git
+.gitignore
+.DS_Store
+*.log
+/home/ubuntu/repo_buildouts/ellie_audit

.env.example

@@ -1,24 +1,42 @@
+# Ellie AI environment template
+# Copy this file to `.env` for local development. Never commit real secrets.
+
+# -----------------------------------------------------------------------------
+# Runtime
+# -----------------------------------------------------------------------------
+NODE_ENV=development
+PORT=3000
+VITE_APP_ID=ellie-ai-local
+VITE_APP_TITLE="Ellie AI"
+
+# -----------------------------------------------------------------------------
 # Database
+# -----------------------------------------------------------------------------
+# Required for production readiness. Ellie persists uploaded video metadata and
+# AI analysis results in a MySQL-compatible database through Drizzle ORM.
 DATABASE_URL=mysql://user:password@localhost:3306/ellie_ai
 
-# Authentication
-JWT_SECRET=your-jwt-secret-here
-VITE_APP_ID=your-app-id
-OAUTH_SERVER_URL=https://your-oauth-server.com
-VITE_OAUTH_PORTAL_URL=https://your-oauth-portal.com
-
-# AI Services (LLM - Gemini 2.5 Flash)
-BUILT_IN_FORGE_API_URL=https://your-llm-api-url.com
-BUILT_IN_FORGE_API_KEY=your-llm-api-key
+# -----------------------------------------------------------------------------
+# Sessions and optional owner authentication
+# -----------------------------------------------------------------------------
+# Required in production for secure session cookies. Generate a high-entropy
+# value with a password manager or: openssl rand -base64 48
+JWT_SECRET=replace-with-a-high-entropy-secret
 
-# Frontend AI Access
-VITE_FRONTEND_FORGE_API_URL=https://your-frontend-api-url.com
-VITE_FRONTEND_FORGE_API_KEY=your-frontend-api-key
+# Optional. Configure these only when owner/admin authentication is enabled.
+OAUTH_SERVER_URL=
+OWNER_OPEN_ID=
 
-# Owner Info
-OWNER_OPEN_ID=your-owner-open-id
-OWNER_NAME=Your Name
+# -----------------------------------------------------------------------------
+# Forge-compatible AI, transcription, and storage proxy
+# -----------------------------------------------------------------------------
+# Required for production readiness. These credentials back Gemini-style video
+# analysis, Whisper-style voice transcription, and object storage proxy uploads.
+BUILT_IN_FORGE_API_URL=https://api.example.com/
+BUILT_IN_FORGE_API_KEY=replace-with-forge-compatible-api-key
 
-# App Config
-VITE_APP_TITLE=Ellie AI
-VITE_APP_LOGO=
+# -----------------------------------------------------------------------------
+# Client-visible branding metadata
+# -----------------------------------------------------------------------------
+# Public values only. Do not put secrets in VITE_* variables.
+VITE_APP_LOGO_URL=/assets/icon.png

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,139 +1,88 @@
-## Description
+## Summary
 
-<!-- Provide a brief description of the changes in this PR -->
+Describe the change in plain language. Include product impact, backend impact, and the reason this change is needed.
 
 ## Type of Change
 
-<!-- Mark the relevant option with an "x" -->
-
-- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
-- [ ] ✨ New feature (non-breaking change which adds functionality)
-- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] 📝 Documentation update
-- [ ] 🎨 Style/UI update (no functional changes)
-- [ ] ♻️ Code refactoring (no functional changes)
-- [ ] ⚡ Performance improvement
-- [ ] ✅ Test update
-- [ ] 🔧 Build/CI update
-- [ ] 🔒 Security update
-
-## Related Issues
-
-<!-- Link to related issues using #issue_number -->
-
-Closes #
-Related to #
-
-## Changes Made
-
-<!-- List the main changes made in this PR -->
-
-- 
-- 
-- 
-
-## Testing
-
-<!-- Describe the tests you ran and how to reproduce them -->
-
-### Test Environment
-- [ ] Local development
-- [ ] Docker containers
-- [ ] Staging environment
-
-### Tests Performed
-- [ ] Unit tests pass
-- [ ] Integration tests pass
-- [ ] Manual testing completed
-- [ ] Browser testing (if frontend changes)
-
-### Test Commands
-```bash
-# Commands used to test these changes
-npm test
-npm run lint
-npm run type-check
+- [ ] Feature
+- [ ] Bug fix
+- [ ] Backend hardening
+- [ ] Security hardening
+- [ ] Documentation
+- [ ] Release / deployment
+- [ ] Refactor
+- [ ] Test update
+- [ ] Dependency or tooling update
+
+## Product and User Impact
+
+Explain what users, operators, or maintainers will notice after this change.
+
+## Backend and Data Impact
+
+| Question | Answer |
+|---|---|
+| Does this change tRPC procedures, server middleware, or operational endpoints? |  |
+| Does this change the database schema or migrations? |  |
+| Does this change storage, AI provider, auth, or background-processing behavior? |  |
+| Does this introduce new environment variables or secrets? |  |
+| Does this affect `/api/health`, `/api/readiness`, or `/api/ready`? |  |
+
+## Validation Evidence
+
+Check every command that was run and paste relevant output or artifact links in the notes below.
+
+- [ ] `pnpm install --frozen-lockfile`
+- [ ] `pnpm validate:env`
+- [ ] `pnpm validate:env:production`
+- [ ] `pnpm check`
+- [ ] `pnpm test`
+- [ ] `pnpm build`
+- [ ] `pnpm run ci`
+- [ ] Runtime smoke test: `/api/health`
+- [ ] Runtime smoke test: `/api/readiness` or `/api/ready`
+- [ ] Docker build and container smoke test
+- [ ] Not applicable; this is documentation-only
+
+### Validation Notes
+
+```text
+Paste command output summaries, health/readiness responses, or CI links here. Redact secrets.
 ```
 
-## Screenshots
-
-<!-- If applicable, add screenshots to help explain your changes -->
+## Screenshots or Recordings
 
-## Checklist
+Add screenshots for UI changes. If no visual surface changed, write `Not applicable`.
 
-<!-- Mark completed items with an "x" -->
+## Documentation and Release Notes
 
-### Code Quality
-- [ ] My code follows the project's style guidelines
-- [ ] I have performed a self-review of my code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] My changes generate no new warnings
-- [ ] I have run `npm run lint` and fixed all issues
-- [ ] I have run `npm run format` to format my code
+- [ ] `README.md` updated or verified as still accurate
+- [ ] `SETUP.md` updated or verified as still accurate
+- [ ] `docs/PRODUCTION_READINESS.md` updated or verified as still accurate
+- [ ] `RELEASES.md` updated or verified as still accurate
+- [ ] `.env.example` updated when configuration changed
+- [ ] Migration or deployment notes added when required
 
-### Testing
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] New and existing unit tests pass locally with my changes
-- [ ] I have run `npm test` and all tests pass
-- [ ] I have tested on multiple browsers (if frontend changes)
+## Security Checklist
 
-### Documentation
-- [ ] I have updated the documentation accordingly
-- [ ] I have updated the README if needed
-- [ ] I have added/updated JSDoc comments for new functions
-- [ ] I have updated the CHANGELOG (if applicable)
+- [ ] No secrets, tokens, private media, `.env` files, or credentials are committed
+- [ ] New inputs are validated before use
+- [ ] Auth and ownership checks are preserved or improved
+- [ ] Provider credentials are read from environment or secret stores only
+- [ ] Dependency changes are intentional and documented
 
-### Dependencies
-- [ ] I have not added unnecessary dependencies
-- [ ] All new dependencies are properly documented
-- [ ] I have run `npm audit` and addressed any issues
+## Reviewer Focus Areas
 
-### Security
-- [ ] My changes do not introduce security vulnerabilities
-- [ ] I have not committed sensitive information (API keys, passwords, etc.)
-- [ ] I have followed security best practices
+List the files or behaviors reviewers should inspect most carefully.
 
-## Performance Impact
-
-<!-- Describe any performance implications of your changes -->
-
-- [ ] No performance impact
-- [ ] Performance improved
-- [ ] Performance may be affected (explain below)
-
-## Breaking Changes
-
-<!-- If this PR includes breaking changes, describe them here -->
+-
+-
+-
 
 ## Deployment Notes
 
-<!-- Any special deployment considerations? -->
-
-## Additional Context
-
-<!-- Add any other context about the PR here -->
-
----
-
-## For Reviewers
-
-### Review Focus Areas
-<!-- Highlight specific areas that need careful review -->
-
-- 
-- 
-
-### Questions for Reviewers
-<!-- Any specific questions or concerns? -->
-
-- 
-- 
+Describe rollout requirements, required secrets, database migrations, rollback considerations, and monitoring checks.
 
----
+## Related Issues or Follow-Ups
 
-**PR Author Checklist:**
-- [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md)
-- [ ] I have assigned appropriate labels
-- [ ] I have requested reviews from relevant team members
-- [ ] I have linked related issues
-- [ ] All CI checks are passing
+Link related issues, TODOs, or planned follow-up PRs.