[codex] Add agentic RAG and local-first runtime

.github/workflows/ci.yml

@@ -18,6 +18,29 @@ env:
   PG_DSN: postgresql+psycopg://second_brain:second_brain@localhost:5432/second_brain
 
 jobs:
+  compose-config:
+    name: Compose config render
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Render production + VPS template
+        env:
+          POSTGRES_USER: second_brain
+          POSTGRES_PASSWORD: dummy_postgres_password
+          POSTGRES_DB: second_brain
+          SECOND_BRAIN_API_TOKEN: dummy_api_token
+          SECOND_BRAIN_ADMIN_TOKEN: dummy_admin_token
+          SECOND_BRAIN_LLM_PROVIDER: fake
+          SECOND_BRAIN_GEMINI_API_KEY: dummy_gemini_key
+          NEXT_PUBLIC_API_BASE_URL: https://127.0.0.1.sslip.io/api
+          SECOND_BRAIN_CORS_ORIGINS: '["https://127.0.0.1.sslip.io"]'
+          CADDY_SITE_ADDRESS: 127.0.0.1.sslip.io
+        run: |
+          docker compose -p second-brain \
+            -f deploy/docker-compose.prod.yml \
+            -f deploy/docker-compose.vps.yml.example \
+            config >/tmp/second-brain-compose.yml
+
   unit-tests:
     name: Unit tests (DB-free)
     runs-on: ubuntu-latest

.gitignore

@@ -32,6 +32,7 @@ mlflow.db
 # OS
 Thumbs.db
 .DS_Store
+*.log
 
 # Local agent/tooling dirs (not project artifacts)
 .claude/

AGENTS.md

@@ -22,8 +22,11 @@ integrated.
   JSONB + materialized-view analytics + RLS/audit. Redis for caching/rate-limit only.
 - **Backend:** Python + FastAPI. **Frontend:** Next.js + TypeScript. **Agent tools:** MCP server.
 - **MLOps:** MLflow for eval + prompt/model versioning. **CI/CD:** GitHub Actions, eval-gated.
-- **Observability:** self-hosted Prometheus + Grafana.
-- **Runtime:** ONE small VPS (~$4–6/mo), everything in Docker Compose. Keep cost minimal.
+- **Observability:** Prometheus-compatible metrics plus retained Prometheus/Grafana configs; run
+  dashboards locally or during optional demos instead of paying for always-on monitoring.
+- **Runtime:** local-first Docker Compose. Run the stack on demand on the owner's machine; any
+  VPS/cloud deployment is optional, temporary, and must be explicitly approved before it creates
+  a recurring bill.
 - **Kubernetes** is a LEARNING TRACK only (Phase 7): real manifests + HPA + ingress + CI/CD
   proven on free local k3s/kind, then torn down. NOT the production runtime. Managed-cluster
   (GKE/EKS) demo is optional and must be deleted immediately after.
@@ -36,23 +39,23 @@ integrated.
 3. Evaluation + MLOps: eval set, MLflow harness, A/B, prompt versioning + rollback
 4. MCP server + agentic actions incl. self-research tool
 5. Daily briefing + scheduled pipelines
-6. Productionize on VPS + data-ops hardening (RLS, retention, pooling, query tuning)
+6. Operations hardening + optional cloud deploy recipe (RLS, retention, pooling, query tuning)
 7. Kubernetes learning track on local k3s/kind
 
 ## How to work
 
 - **Engineer-grade:** write ADRs for real decisions, tests alongside code, keep a deploy
   checklist. Use established engineering workflows where they fit.
-- **Cost-conscious:** never propose anything with a recurring bill beyond the one VPS
-  without flagging it explicitly and waiting for my OK.
+- **Cost-conscious:** never propose anything with a recurring infrastructure bill without
+  flagging it explicitly and waiting for my OK.
 - **Incremental:** end each working chunk with something runnable or reviewable, and tell
   me how to run/verify it. Don't dump huge unrunnable scaffolds.
 - **Ask before assuming** on anything that affects architecture, cost, or data privacy.
 - **No session/token cost pauses:** I'm on a Claude Max subscription — the per-session
   dollar figure shown in tooling is an *estimate of equivalent API cost*, not a billed
   amount. Do NOT pause, check in, or ask for re-approval based on session/token cost
   (including when it "doubles" or crosses a threshold). The "cost-conscious" rule above
-  refers ONLY to recurring infrastructure bills (e.g. the VPS) — flag those, not session cost.
+  refers ONLY to recurring infrastructure bills — flag those, not session cost.
 - **Keep records current:** update `docs/PROGRESS.md` at the end of each session (status +
   dated log), and append to `docs/implementation-notes.md` whenever you make a decision,
   change, or trade-off that wasn't in the spec (what / why / what I gave up).
@@ -64,7 +67,7 @@ integrated.
   tier, which is separate from my subscription.
 - I may use multiple coding agents (Claude, Codex, Antigravity) on this repo — this file is
   the shared source of truth; `CLAUDE.md` just points here.
-- [TODO: add your OS, strongest languages, and chosen VPS once decided.]
+- [TODO: add your OS and strongest languages.]
 
 ## Note for non-Claude agents