Build the ClauseGuard full-stack contract review workbench

.env.example

@@ -19,3 +19,15 @@ CLAUSEGUARD_MAX_VERIFIER_INPUT_TOKENS=7000
 
 # Test/demo mode only. Leave false for real agentic cloud runs.
 CLAUSEGUARD_MOCK_MODELS=false
+
+# Go control plane. The workspace is auto-discovered when this is left blank.
+CLAUSEGUARD_SERVER_ADDR=127.0.0.1:8080
+CLAUSEGUARD_PYTHON=python
+CLAUSEGUARD_WORKSPACE=
+CLAUSEGUARD_DATA_DIR=.clauseguard
+CLAUSEGUARD_WEB_DIR=apps/web/dist
+CLAUSEGUARD_MAX_UPLOAD_BYTES=26214400
+CLAUSEGUARD_JOB_TIMEOUT=10m
+CLAUSEGUARD_MAX_CONCURRENT_JOBS=2
+CLAUSEGUARD_MAX_ACTIVE_JOBS=20
+CLAUSEGUARD_ALLOWED_ORIGIN=http://localhost:5173

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: "/apps/web"
+    schedule:
+      interval: monthly
+    groups:
+      web-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: "/apps/server"
+    schedule:
+      interval: monthly
+    groups:
+      go-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -27,5 +27,90 @@ jobs:
         run: python -m flake8 clauseguard tests scripts
       - name: Type check
         run: python -m mypy clauseguard
+      - name: Audit runtime dependencies
+        run: python -m pip_audit . --progress-spinner off
       - name: Test
         run: python -m pytest --cov=clauseguard --cov-report=term-missing --cov-fail-under=80
+
+  web:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+      - run: npm ci
+      - run: npm audit --audit-level=high
+      - run: npm run lint
+      - run: npm run test:coverage
+      - run: npm run build
+
+  control-plane:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/server
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: apps/server/go.mod
+          cache-dependency-path: apps/server/go.sum
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+      - name: Install Python analysis engine
+        working-directory: .
+        run: python -m pip install -e .
+      - name: Check formatting
+        run: test -z "$(gofmt -l .)"
+      - name: Vet
+        run: go vet ./...
+      - name: Audit dependencies
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          govulncheck ./...
+      - name: Test control plane and Python bridge
+        env:
+          CLAUSEGUARD_INTEGRATION_PYTHON: python
+          CLAUSEGUARD_INTEGRATION_WORKSPACE: ${{ github.workspace }}
+        run: |
+          go test -race -coverpkg=./... -coverprofile=coverage.out ./...
+          total="$(go tool cover -func=coverage.out | awk '/^total:/ {gsub(/%/, "", $3); print $3}')"
+          echo "Go statement coverage: ${total}%"
+          awk -v total="$total" 'BEGIN { if (total < 70) exit 1 }'
+      - name: Build
+        run: go build ./...
+
+  demo-e2e:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: apps/server/go.mod
+          cache-dependency-path: apps/server/go.sum
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+      - name: Install application
+        working-directory: .
+        run: python -m pip install -e .
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, go, javascript-typescript]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        if: matrix.language == 'go'
+        with:
+          go-version-file: apps/server/go.mod
+          cache-dependency-path: apps/server/go.sum
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@v4
+        if: matrix.language == 'go'
+      - uses: github/codeql-action/analyze@v4

.gitignore

@@ -8,11 +8,11 @@ env/
 
 # Local assistant/editor state
 .agents/
-.codex/
 
 # Vectorstore
 qdrant_storage
-.clauseguard/
+.clauseguard*/
+.runtime-*/
 analysis_outputs/
 test_outputs/
 
@@ -31,12 +31,12 @@ dist/
 downloads/
 eggs/
 .eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
+/lib/
+/lib64/
+/parts/
+/sdist/
+/var/
+/wheels/
 *.egg-info/
 .installed.cfg
 *.egg
@@ -52,3 +52,15 @@ wheels/
 *.zip
 process.ipynb
 /[0-9]*
+
+# Go control-plane binaries
+/apps/server/clauseguard-server
+/apps/server/clauseguard-server.exe
+/apps/server/coverage.out
+
+# Web workbench
+/apps/web/node_modules/
+/apps/web/dist/
+/apps/web/coverage/
+/apps/web/playwright-report/
+/apps/web/test-results/