Merge pull request #3 from jhd3197/dev

Identity/RBAC, public API + MCP, workflow v2 & fleet policy

Author: jhd3197

.env.example

@@ -1,7 +1,7 @@
 # DeviceKit Environment Configuration
 
 # API
-API_PORT=5050
+API_PORT=7317
 API_HOST=0.0.0.0
 
 # AWS
@@ -19,7 +19,7 @@ DYNAMODB_ENDPOINT=http://localhost:8000
 # DEVICEKIT_DATABASE_URL=sqlite:///devicekit.db
 
 # CORS
-CORS_ORIGINS=http://localhost:5173,http://localhost:3000
+CORS_ORIGINS=http://localhost:7318,http://localhost:3000
 
 # Devices (comma-separated serial numbers)
 DEVICE_IDS=
@@ -34,3 +34,8 @@ OPENAI_API_KEY=sk-...
 # GROQ_API_KEY=gsk_...
 # GOOGLE_API_KEY=AI...
 # OLLAMA_HOST=http://localhost:11434
+
+# Prompture Hub (optional AI backend — ai.backend=hub in Settings → AI).
+# HUB_ADMIN_TOKEN lets DeviceKit mint per-extension scoped hub keys (model whitelist +
+# daily spend cap). Must match the token the hub itself runs with. Env-only on purpose.
+# HUB_ADMIN_TOKEN=change-me

.github/workflows/device-tests.yml

@@ -10,7 +10,7 @@ on:
 
 env:
   PYTHON_VERSION: "3.11"
-  DEVICEKIT_URL: ${{ secrets.DEVICEKIT_URL || 'http://127.0.0.1:5050' }}
+  DEVICEKIT_URL: ${{ secrets.DEVICEKIT_URL || 'http://127.0.0.1:7317' }}
   DEVICEKIT_API_KEY: ${{ secrets.DEVICEKIT_API_KEY }}
 
 jobs:
@@ -47,7 +47,7 @@ jobs:
           python app.py &
           echo "Waiting for backend to start..."
           for i in $(seq 1 30); do
-            if curl -sf http://127.0.0.1:5050/health > /dev/null 2>&1; then
+            if curl -sf http://127.0.0.1:7317/health > /dev/null 2>&1; then
               echo "Backend is ready"
               break
             fi

.gitignore

@@ -72,6 +72,10 @@ instance/
 backend/devicekit.db
 backend/recordings/
 backend/output/debug_bundles/
+# OTA (plan 25): signed APK releases + the Ed25519 private signing key — never commit these
+backend/output/ota/
+# Backups (plan 25): tarballs contain full DB snapshots — never commit these
+backend/output/backups/
 backend/.apk_cache/
 
 # Installed extensions are extracted here at runtime (tracked: only the package marker)
@@ -236,3 +240,8 @@ docs/plans/prompt.md
 
 # Generated PR descriptions (create-pr skill output — local scratch)
 .pr/
+image.png
+*.png
+# …but the README/demo screenshots are committed (captured via `npm run shots`).
+!docs/screenshots/*.png
+!docs/assets/*.png