JasonPaff · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026
diff --git a/.atk-lock.json b/.atk-lock.json
@@ -1,8 +1,119 @@
 {
   "assets": [
+    {
+      "dependencies": [],
+      "description": "This rule ensures the agent uses the validate agent for running the projects validation commands (lint, typecheck, tests)",
+      "files": [
+        {
+          "checksum": "07b9425c82fd24a6c8185821368662856e8fd506c82537f006df296fed2a17dd",
+          "installedPath": ".claude/rules/dev-commands-rule.md",
+          "sourcePath": "dev-commands-rule.md"
+        }
+      ],
+      "installReason": "direct",
+      "name": "dev-commands-rule",
+      "org": "agentic-toolkit",
+      "type": "rule",
+      "version": "1.0.0"
+    },
+    {
+      "dependencies": [],
+      "description": "Runs lint, typecheck, and test commands and returns a concise summary of the results.",
+      "files": [
+        {
+          "checksum": "56c5e7bee8a41eeecb6d0f5f8e9b90d33a4a4f6b0404ae1524a9ae187a0f789a",
+          "installedPath": ".claude/agents/validate.md",
+          "sourcePath": "validate.md"
+        }
+      ],
+      "installReason": "direct",
+      "name": "validate",
+      "org": "agentic-toolkit",
+      "type": "agent",
+      "version": "1.0.0"
+    },
+    {
+      "dependencies": [],
+      "description": "Researches library documentation and code examples via Context7 MCP server without filling up the main context window",
+      "files": [
+        {
+          "checksum": "600539b12f7db7785072ba21d5b7a2a201bddc4affd1526f264067f36cf0edef",
+          "installedPath": ".claude/agents/context7-researcher.md",
+          "sourcePath": "context7-researcher.md"
+        }
+      ],
+      "installReason": "direct",
+      "name": "context7-researcher",
+      "type": "agent",
+      "version": "1.0.0"
+    },
+    {
+      "dependencies": [],
+      "description": "Create a Conventional Commits formatted commit",
+      "entrypoint": "SKILL.md",
+      "files": [
+        {
+          "checksum": "599bc03dc018cff72f5283b2bf3396cfb2913d04bb521c6e76d56eb88d797fa3",
+          "installedPath": ".claude/skills/conventional-commit/SKILL.md",
+          "sourcePath": "SKILL.md"
+        }
+      ],
+      "installReason": "direct",
+      "name": "conventional-commit",
+      "type": "skill",
+      "version": "1.0.1"
+    },
+    {
+      "configEntries": [
+        {
+          "checksum": "3a0c1791257b563b3d503f0b2112369702f03f341f12dad48f10ee39b411e69d",
+          "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/notify-on-stop-hook.sh",
+          "file": ".claude/settings.json",
+          "key": "hooks.Stop"
+        }
+      ],
+      "dependencies": [],
+      "description": "Sends a desktop notification when Claude Code finishes responding (Stop event)",
+      "entrypoint": "notify-on-stop-hook.sh",
+      "files": [
+        {
+          "checksum": "48deb177acce3d0882c28062246828f680c000baff87d9fe740f27106dbda7a8",
+          "sourcePath": "notify-on-stop-hook.sh"
+        }
+      ],
+      "installReason": "direct",
+      "name": "notify-on-stop-hook",
+      "type": "hook",
+      "version": "1.2.0"
+    },
+    {
+      "configEntries": [
+        {
+          "checksum": "91c0be034149b6af4c8aab9122fd8b22647aaee609d2b7a96f10e71944252379",
+          "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/notify-on-question-hook.sh",
+          "file": ".claude/settings.json",
+          "key": "hooks.PreToolUse"
+        }
+      ],
+      "dependencies": [],
+      "description": "Plays a double beep when Claude Code is about to prompt with AskUserQuestion, so you know to check the terminal before the questions time out",
+      "entrypoint": "notify-on-question-hook.sh",
+      "files": [
+        {
+          "checksum": "f8478ef78f43d4b32a4098d31ca31bd9b7b1fbeb88d0e2d03947041eca5bf44e",
+          "installedPath": ".claude/hooks/notify-on-question-hook.sh",
+          "sourcePath": "notify-on-question-hook.sh"
+        }
+      ],
+      "installReason": "direct",
+      "name": "notify-on-question-hook",
+      "type": "hook",
+      "version": "1.1.0"
+    },
     {
       "dependencies": [],
       "description": "Comprehensive reference guide for the Agentic Tool Kit (ATK) CLI and web app — covers every command, non-interactive flags for scripted/agent-driven use (publish, init, install, etc.), JSON output mode, core concepts (lockfile, tool adapters, trust levels, checksums), authentication, and troubleshooting. Use when the user asks how to do something in ATK, wants to know what a flag does, is debugging an ATK error, is authoring or publishing a new asset, asks Claude to publish/install/manage assets on their behalf, or needs clarification on ATK concepts like setup, sync, pin/freeze, or the org scope.",
+      "entrypoint": "SKILL.md",
       "files": [
         {
           "checksum": "030a699c7a13e12533b7a95b4d9e9b04a82796f9a238e782ffd49bc9b4d24616",
@@ -199,116 +310,6 @@
       "name": "atk-guide",
       "type": "skill",
       "version": "1.3.0"
-    },
-    {
-      "dependencies": [],
-      "description": "This rule ensures the agent uses the validate agent for running the projects validation commands (lint, typecheck, tests)",
-      "files": [
-        {
-          "checksum": "07b9425c82fd24a6c8185821368662856e8fd506c82537f006df296fed2a17dd",
-          "installedPath": ".claude/rules/dev-commands-rule.md",
-          "sourcePath": "dev-commands-rule.md"
-        }
-      ],
-      "installReason": "direct",
-      "name": "dev-commands-rule",
-      "org": "agentic-toolkit",
-      "type": "rule",
-      "version": "1.0.0"
-    },
-    {
-      "dependencies": [],
-      "description": "Runs lint, typecheck, and test commands and returns a concise summary of the results.",
-      "files": [
-        {
-          "checksum": "56c5e7bee8a41eeecb6d0f5f8e9b90d33a4a4f6b0404ae1524a9ae187a0f789a",
-          "installedPath": ".claude/agents/validate.md",
-          "sourcePath": "validate.md"
-        }
-      ],
-      "installReason": "direct",
-      "name": "validate",
-      "org": "agentic-toolkit",
-      "type": "agent",
-      "version": "1.0.0"
-    },
-    {
-      "dependencies": [],
-      "description": "Researches library documentation and code examples via Context7 MCP server without filling up the main context window",
-      "files": [
-        {
-          "checksum": "600539b12f7db7785072ba21d5b7a2a201bddc4affd1526f264067f36cf0edef",
-          "installedPath": ".claude/agents/context7-researcher.md",
-          "sourcePath": "context7-researcher.md"
-        }
-      ],
-      "installReason": "direct",
-      "name": "context7-researcher",
-      "type": "agent",
-      "version": "1.0.0"
-    },
-    {
-      "configEntries": [
-        {
-          "checksum": "91c0be034149b6af4c8aab9122fd8b22647aaee609d2b7a96f10e71944252379",
-          "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/notify-on-question-hook.sh",
-          "file": ".claude/settings.json",
-          "key": "hooks.PreToolUse"
-        }
-      ],
-      "dependencies": [],
-      "description": "Plays a double beep when Claude Code is about to prompt with AskUserQuestion, so you know to check the terminal before the questions time out",
-      "entrypoint": "notify-on-question-hook.sh",
-      "files": [
-        {
-          "checksum": "f8478ef78f43d4b32a4098d31ca31bd9b7b1fbeb88d0e2d03947041eca5bf44e",
-          "installedPath": ".claude/hooks/notify-on-question-hook.sh",
-          "sourcePath": "notify-on-question-hook.sh"
-        }
-      ],
-      "installReason": "direct",
-      "name": "notify-on-question-hook",
-      "type": "hook",
-      "version": "1.1.0"
-    },
-    {
-      "dependencies": [],
-      "description": "Create a Conventional Commits formatted commit",
-      "entrypoint": "SKILL.md",
-      "files": [
-        {
-          "checksum": "599bc03dc018cff72f5283b2bf3396cfb2913d04bb521c6e76d56eb88d797fa3",
-          "installedPath": ".claude/skills/conventional-commit/SKILL.md",
-          "sourcePath": "SKILL.md"
-        }
-      ],
-      "installReason": "direct",
-      "name": "conventional-commit",
-      "type": "skill",
-      "version": "1.0.1"
-    },
-    {
-      "configEntries": [
-        {
-          "checksum": "3a0c1791257b563b3d503f0b2112369702f03f341f12dad48f10ee39b411e69d",
-          "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/notify-on-stop-hook.sh",
-          "file": ".claude/settings.json",
-          "key": "hooks.Stop"
-        }
-      ],
-      "dependencies": [],
-      "description": "Sends a desktop notification when Claude Code finishes responding (Stop event)",
-      "entrypoint": "notify-on-stop-hook.sh",
-      "files": [
-        {
-          "checksum": "48deb177acce3d0882c28062246828f680c000baff87d9fe740f27106dbda7a8",
-          "sourcePath": "notify-on-stop-hook.sh"
-        }
-      ],
-      "installReason": "direct",
-      "name": "notify-on-stop-hook",
-      "type": "hook",
-      "version": "1.2.0"
     }
   ],
   "lockVersion": 1

diff --git a/.env.example b/.env.example
@@ -18,8 +18,12 @@ NODE_ENV=development
 # fatal | error | warn | info | debug | trace. Unset → info in production, debug otherwise.
 LOG_LEVEL=debug
 
-# Listen port for the long-lived services (api defaults to 3001, match to 2567).
-PORT=3001
+# Listen port for the long-lived services. Leave EMPTY for local dev: this one
+# file feeds api, match, and bots at once, so each service falls back to its own
+# default (api 3001, match 2567, bots 2568) — a concrete value here would force
+# all three onto the same port. Fly sets a real PORT per app in production; to
+# override a single local process, set PORT as a real env var (it wins over .env).
+PORT=
 
 # Neon Postgres connection string.
 DATABASE_URL=postgresql://user:password@host.neon.tech/dbname?sslmode=require

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -117,7 +117,8 @@ jobs:
 
       - name: Deploy ${{ matrix.app }} to Fly.io
         # Run from the repo root so the Docker build context is the whole workspace
-        # (each Dockerfile COPYs `packages/` and `apps/`). See infra/README.md §5.
-        run: flyctl deploy --config apps/${{ matrix.app }}/fly.toml --dockerfile apps/${{ matrix.app }}/Dockerfile --remote-only
+        # (the root Dockerfile COPYs `packages/` and `apps/`). Each fly.toml's
+        # [build] section owns the Dockerfile path and build args. See infra/README.md §5.
+        run: flyctl deploy --config apps/${{ matrix.app }}/fly.toml --remote-only
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -0,0 +1,105 @@
+name: E2E
+
+# The browser smoke (capability `web-e2e-smoke`): Playwright boots the real
+# four-service stack in the runner against the dev cloud resources and drives
+# the signed-in happy path. Deliberately NOT part of the quality gate and NOT
+# a required check at introduction (design D6) — promotion to required is a
+# later `main`-ruleset edit, no workflow change.
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    name: Browser smoke
+    runs-on: ubuntu-latest
+    # Stack boot + (test ceiling 10 min) × (1 + 1 retry), plus browser install.
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        # Version is taken from the root package.json "packageManager" field.
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node 22 (with pnpm store cache)
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Playwright chromium
+        run: pnpm --filter @meldrank/web exec playwright install chromium --with-deps
+
+      # The services read the repo-root `.env` themselves (loadLocalEnv) and
+      # Next reads `apps/web/.env.local` — materialize both from secrets, the
+      # exact contract a developer machine uses (design D2). `PORT=` stays
+      # empty so each service binds its own default. The localhost URLs and
+      # the publishable key (a repository *variable* — it is public by design)
+      # are not secrets.
+      - name: Materialize env files from secrets
+        run: |
+          cat > .env <<EOF
+          NODE_ENV=development
+          LOG_LEVEL=info
+          PORT=
+          DATABASE_URL=${DATABASE_URL}
+          UPSTASH_REDIS_REST_URL=${UPSTASH_REDIS_REST_URL}
+          UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN}
+          CLERK_SECRET_KEY=${CLERK_SECRET_KEY}
+          CLERK_WEBHOOK_SECRET=${CLERK_WEBHOOK_SECRET}
+          INTERNAL_SPAWN_SECRET=${INTERNAL_SPAWN_SECRET}
+          INTERNAL_VERIFY_SECRET=${INTERNAL_VERIFY_SECRET}
+          SEAT_TICKET_SECRET=${SEAT_TICKET_SECRET}
+          INTERNAL_BOTS_SECRET=${INTERNAL_BOTS_SECRET}
+          MATCH_INTERNAL_URL=http://localhost:2567
+          BOTS_INTERNAL_URL=http://localhost:2568
+          MATCH_REALTIME_URL=ws://localhost:2567
+          WEB_APP_ORIGIN=http://localhost:3000
+          NEXT_PUBLIC_APP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_URL=http://localhost:3001
+          NEXT_PUBLIC_MATCH_URL=http://localhost:2567
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
+          EOF
+          cat > apps/web/.env.local <<EOF
+          NEXT_PUBLIC_APP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_URL=http://localhost:3001
+          NEXT_PUBLIC_MATCH_URL=http://localhost:2567
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
+          CLERK_SECRET_KEY=${CLERK_SECRET_KEY}
+          EOF
+        env:
+          DATABASE_URL: ${{ secrets.E2E_DATABASE_URL }}
+          UPSTASH_REDIS_REST_URL: ${{ secrets.E2E_UPSTASH_REDIS_REST_URL }}
+          UPSTASH_REDIS_REST_TOKEN: ${{ secrets.E2E_UPSTASH_REDIS_REST_TOKEN }}
+          CLERK_SECRET_KEY: ${{ secrets.E2E_CLERK_SECRET_KEY }}
+          CLERK_WEBHOOK_SECRET: ${{ secrets.E2E_CLERK_WEBHOOK_SECRET }}
+          INTERNAL_SPAWN_SECRET: ${{ secrets.E2E_INTERNAL_SPAWN_SECRET }}
+          INTERNAL_VERIFY_SECRET: ${{ secrets.E2E_INTERNAL_VERIFY_SECRET }}
+          SEAT_TICKET_SECRET: ${{ secrets.E2E_SEAT_TICKET_SECRET }}
+          INTERNAL_BOTS_SECRET: ${{ secrets.E2E_INTERNAL_BOTS_SECRET }}
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+
+      - name: Run the e2e smoke
+        run: pnpm --filter @meldrank/web test:e2e
+
+      - name: Upload Playwright report and traces
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            apps/web/playwright-report/
+            apps/web/test-results/
+          retention-days: 14
diff --git a/.gitignore b/.gitignore
@@ -21,6 +21,9 @@ next-env.d.ts
 
 # testing
 coverage/
+playwright-report/
+test-results/
+apps/web/e2e/.auth/
 
 # logs
 logs/