Promote dev to main after NeuralLiquid transfer

.env.example

@@ -1,12 +1,18 @@
-# ────────────── Primary Azure OpenAI ──────────────
-AZURE_OPENAI_ENDPOINT=https://your-primary-endpoint.openai.azure.com/
-AZURE_OPENAI_KEY=your_primary_key_here
-AZURE_OPENAI_DEPLOYMENT_GPT35=your-gpt35-deployment-name
-AZURE_OPENAI_DEPLOYMENT_ROUTER=your-model-router-name
+# ────────────── Sluice model routing ──────────────
+# Cognitive Mesh routes model calls through Sluice. Do not configure provider
+# keys here for shared/prod deployments.
+SLUICE_BASE_URL=https://sluice.example.com
+SLUICE_API_KEY=
+SLUICE_MODEL=default
+SLUICE_MAX_TOKENS=16384
 
-# ────────────── Secondary "SAF" Azure OpenAI ──────────────
-AZURE_OPENAI_ENDPOINT_SAF=https://your-saf-endpoint.openai.azure.com/
-AZURE_OPENAI_KEY_SAF=your_saf_key_here
-AZURE_OPENAI_DEPLOYMENT_4O=your-gpt4o-deployment-name
-AZURE_OPENAI_DEPLOYMENT_GPT41=your-gpt41-deployment-name
-AZURE_OPENAI_DEPLOYMENT_EMBEDDINGS=your-embeddings-deployment-name
+# Direct providers are for local mocks or explicit migration shims only.
+ALLOW_DIRECT_MODEL_PROVIDER=false
+
+# ────────────── Cognitive Mesh Frontend Auth ──────────────
+NEXT_PUBLIC_API_BASE_URL=http://localhost:5000
+NEXT_PUBLIC_MYSTIRA_AUTH_CLIENT_ID=d8182e32-4dda-4fc9-83bf-b5d517bc9528
+NEXT_PUBLIC_MYSTIRA_TENANT_ID=9530cd32-9e33-47f0-9247-ed964730b580
+MYSTIRA_IDENTITY_BASE_URL=https://identity.mystira.app
+MYSTIRA_OIDC_CLIENT_ID=neuralliquid-cognitive-mesh-web
+MYSTIRA_OIDC_CLIENT_SECRET=

.github/workflows/api-docs.yml

@@ -20,35 +20,40 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
+    - name: Set up pnpm
+      uses: pnpm/action-setup@v4.4.0
+      with:
+        version: 10.34.5
+
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v6.4.0
       with:
-        node-version: '24.14.0'
-        cache: 'npm'
-        cache-dependency-path: docs/package-lock.json
+        node-version: '24.18.0'
+        cache: 'pnpm'
+        cache-dependency-path: docs/pnpm-lock.yaml
 
     - name: Install dependencies
       working-directory: ./docs
-      run: npm ci
+      run: pnpm install --frozen-lockfile
       env:
         HUSKY: '0'
 
     - name: Build OpenAPI spec
       working-directory: ./docs
-      run: npm run build
+      run: pnpm run build
 
     - name: Validate OpenAPI spec
       working-directory: ./docs
-      run: npm run validate
+      run: pnpm run validate
 
     - name: Run tests
       working-directory: ./docs
-      run: npm test
+      run: pnpm test
 
     - name: Upload coverage report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: coverage-report
@@ -65,27 +70,32 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
+    - name: Set up pnpm
+      uses: pnpm/action-setup@v4.4.0
+      with:
+        version: 10.34.5
+
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v6.4.0
       with:
-        node-version: '24.14.0'
-        cache: 'npm'
-        cache-dependency-path: docs/package-lock.json
+        node-version: '24.18.0'
+        cache: 'pnpm'
+        cache-dependency-path: docs/pnpm-lock.yaml
 
     - name: Install dependencies
       working-directory: ./docs
-      run: npm ci
+      run: pnpm install --frozen-lockfile
       env:
         HUSKY: '0'
 
     - name: Build OpenAPI spec
       working-directory: ./docs
-      run: npm run build
+      run: pnpm run build
 
     - name: Deploy to GitHub Pages
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: ./docs/.redocly
@@ -105,7 +115,7 @@ jobs:
     steps:
     - name: Send notification
       if: failure()
-      uses: rtCamp/action-slack-notify@v2
+      uses: rtCamp/action-slack-notify@v2.4.0
       env:
         SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
         SLACK_COLOR: '#FF0000'

.github/workflows/build.yml

@@ -9,97 +9,57 @@ on:
 
 jobs:
   dotnet:
-    name: .NET build and SonarQube analysis
+    name: .NET build and test
     runs-on: windows-latest
 
     steps:
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: 17
-          distribution: 'zulu'
-
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: actions/checkout@v6.0.3
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v5.4.0
         with:
           dotnet-version: |
             9.0.x
             10.0.x
 
-      - name: Cache SonarQube Cloud packages
-        uses: actions/cache@v5
-        with:
-          path: ~\sonar\cache
-          key: ${{ runner.os }}-sonar
-          restore-keys: ${{ runner.os }}-sonar
+      - name: Build
+        run: dotnet build CognitiveMesh.sln
 
-      - name: Cache SonarQube Cloud scanner
-        id: cache-sonar-scanner
-        uses: actions/cache@v5
-        with:
-          path: ${{ runner.temp }}\scanner
-          key: ${{ runner.os }}-sonar-scanner
-          restore-keys: ${{ runner.os }}-sonar-scanner
-
-      - name: Install SonarQube Cloud scanner
-        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
-        shell: powershell
-        run: |
-          New-Item -Path ${{ runner.temp }}\scanner -ItemType Directory
-          dotnet tool update dotnet-sonarscanner --tool-path ${{ runner.temp }}\scanner
-
-      # Requires repository secret SONAR_TOKEN (generate at https://sonarcloud.io/account/security)
-      - name: Validate SonarQube Cloud configuration
-        shell: powershell
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          if ([string]::IsNullOrWhiteSpace($env:SONAR_TOKEN)) {
-            Write-Error "SONAR_TOKEN secret is not configured. Add it in Settings > Secrets > Actions."
-            exit 1
-          }
-
-      - name: Build and analyze
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        shell: powershell
-        run: |
-          ${{ runner.temp }}\scanner\dotnet-sonarscanner begin /k:"JustAGhosT_cognitive-mesh" /o:"neuralliquid" /d:sonar.token="$env:SONAR_TOKEN" /d:sonar.cs.opencover.reportsPaths="**/coverage.opencover.xml"
-          dotnet build CognitiveMesh.sln
-          dotnet test CognitiveMesh.sln --no-build --collect:"XPlat Code Coverage;Format=opencover" --results-directory TestResults
-          ${{ runner.temp }}\scanner\dotnet-sonarscanner end /d:sonar.token="$env:SONAR_TOKEN"
+      - name: Test
+        run: dotnet test CognitiveMesh.sln --no-build
 
   typescript:
     name: TypeScript validation
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4.4.0
+        with:
+          version: 10.34.5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
-          node-version: '24.14.0'
-          cache: 'npm'
-          cache-dependency-path: docs/package-lock.json
+          node-version: '24.18.0'
+          cache: 'pnpm'
+          cache-dependency-path: docs/pnpm-lock.yaml
 
       - name: Install dependencies
         working-directory: docs
-        run: npm ci
+        run: pnpm install --frozen-lockfile
         env:
           HUSKY: '0'
 
       - name: Validate OpenAPI specs
         working-directory: docs
-        run: npm run validate
+        run: pnpm run validate
 
       - name: Run tests
         working-directory: docs
-        run: npm run test:unit
+        run: pnpm run test:unit
 
   frontend:
     name: Frontend build, lint and test
@@ -110,31 +70,36 @@ jobs:
         working-directory: src/UILayer/web
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4.4.0
+        with:
+          version: 10.34.5
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
-          node-version: '22.22.1'
-          cache: 'npm'
-          cache-dependency-path: src/UILayer/web/package-lock.json
+          node-version: '22.23.1'
+          cache: 'pnpm'
+          cache-dependency-path: src/UILayer/web/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile
 
       - name: Lint
-        run: npm run lint
+        run: pnpm run lint
 
       - name: Type check
-        run: npx tsc --noEmit --skipLibCheck
+        run: pnpm exec tsc --noEmit --skipLibCheck
         continue-on-error: true
 
       - name: Test
-        run: npm test -- --ci --coverage --passWithNoTests
+        run: pnpm test --ci --coverage --passWithNoTests
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: frontend-coverage
           path: src/UILayer/web/coverage/