refactor: move tables into app/core/db

.env.dev

@@ -28,6 +28,6 @@ MCP_WRITE_TOKEN=agentique-dev-write
 MCP_DB_USER=postgres
 MCP_DB_PASSWORD=agentique-dev
 
-# Jev (pipeline/jev.py), the newsletter link classifier. Empty locally: set a
+# Jev (backend/app/core/jev.py), the newsletter link classifier. Empty locally: set a
 # real key only in .env, never here.
 OPENROUTER_API_KEY=

.github/workflows/claude-code-review.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

.github/workflows/claude.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1
+        uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/deploy-production.yml

@@ -49,25 +49,21 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version: "0.11.18"
+      # Straight into frontend/dist, so the one sync below ships it.
       - name: Download dist
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: frontend-dist
-          path: frontend-dist
+          path: frontend/dist
       # The workspace is a staging area only — actions/checkout resets it every
-      # run, so the services live in /opt/agentique. .env and .venv belong to
-      # the box; frontend/dist is replaced separately below.
-      - name: Sync source to /opt/agentique
-        run: >
-          rsync -a --delete
-          --exclude '.git'
-          --exclude '.env'
-          --exclude '.venv'
-          --exclude 'frontend/dist'
-          --exclude 'frontend-dist'
-          ./ /opt/agentique/
-      - name: Sync frontend dist
-        run: rsync -a --delete frontend-dist/ /opt/agentique/frontend/dist/
+      # run, so the services live in /opt/agentique. deploy/rsync-filter lists
+      # what the box runs; --delete-excluded removes everything else there,
+      # except what the filter protects (.env, .venv, .git). A missing dist
+      # would delete the live site, so check for it first.
+      - name: Sync to /opt/agentique
+        run: |
+          test -f frontend/dist/index.html
+          rsync -a --delete --delete-excluded --filter='merge deploy/rsync-filter' ./ /opt/agentique/
       # --package app: the workspace root is virtual, a bare sync would not
       # install the backend (same flag the old Dockerfile used).
       - name: Sync venv
@@ -76,7 +72,7 @@ jobs:
       # --env-file is load-bearing: prestart.sh's seed guard checks the shell
       # ENVIRONMENT, and a bare deploy shell doesn't have it.
       - name: Run migrations + prestart
-        run: uv run --env-file ../.env bash scripts/prestart.sh
+        run: uv run --env-file ../.env bash app/entry/cli/prestart.sh
         working-directory: /opt/agentique/backend
       - name: Restart backend
         run: sudo systemctl restart agentique-backend

.github/workflows/test-backend.yml

@@ -39,12 +39,15 @@ jobs:
           POSTGRES_USER=postgres
           POSTGRES_PASSWORD=ci-test-password
           EOF
+      - name: Check import layers
+        run: uv run lint-imports
+        working-directory: backend
       - run: docker compose up -d
       - name: Migrate DB
-        run: uv run bash scripts/prestart.sh
+        run: uv run bash app/entry/cli/prestart.sh
         working-directory: backend
       - name: Run tests
-        run: uv run bash scripts/tests-start.sh "Coverage for ${{ github.sha }}"
+        run: uv run bash ../scripts/tests-start.sh "Coverage for ${{ github.sha }}"
         working-directory: backend
       - run: docker compose down -v
       - name: Store coverage files

.pre-commit-config.yaml

@@ -14,7 +14,7 @@ repos:
             (?x)^(
                 frontend/src/client/.*|
                 backend/baml_client/.*|
-                backend/app/core/email-templates/.*
+                backend/app/features/(audience|newsletter)/.*\.html
             )$
       - id: trailing-whitespace
         exclude: |
@@ -53,14 +53,21 @@ repos:
 
       - id: local-mypy
         name: mypy check
-        entry: uv run mypy backend/app backend/scripts
+        entry: uv run mypy --config-file backend/pyproject.toml backend/app
         require_serial: true
         language: unsupported
         pass_filenames: false
 
       - id: local-ty
         name: ty check
-        entry: uv run ty check backend/app backend/scripts
+        entry: uv run ty check --project backend backend/app
+        require_serial: true
+        language: unsupported
+        pass_filenames: false
+
+      - id: local-lint-imports
+        name: import-linter
+        entry: uv run lint-imports --config backend/pyproject.toml
         require_serial: true
         language: unsupported
         pass_filenames: false

CLAUDE.md

@@ -36,7 +36,7 @@
 - Read and mutate freely. It's a local copy, not prod.
 
 ## MCP tools
-- `.mcp.json` connects to the `agentique` MCP server (`backend/app/mcp/`), exposing `sql_query` (read-only prod Postgres), `web_fetch`, `web_search`.
+- `.mcp.json` connects to the `agentique` MCP server (`backend/app/entry/mcp/`), exposing `sql_query` (read-only prod Postgres), `web_fetch`, `web_search`.
 - With the write token it also exposes `list_candidates`, `get_content`, `similar`, `stories`, `check_link`, `vocabulary`, `approve`, `reject`, `reject_many` - the curation agent's tools. They publish to prod. Don't call them outside a curation session.
 - The write token also reaches `week`, `related`, `draft_issue` - the newsletter agent's tools (`.claude/skills/newsletter/SKILL.md`). `draft_issue` creates a Resend draft addressed to every subscriber; sending is done by hand in Resend.
 - And `story_candidates`, `save_story`, `close_story` - the stories agent's tools (`.claude/skills/stories/SKILL.md`). They write the right rail's stories in prod.