grim7/11/2026, 11:43:12 AM

- db: createAuth (better-auth + drizzle adapter, uuidv7 ids, forge_identities
  hook); api mounts /api/auth/* with credentialed cors
- web: vite proxy for /api/auth, auth client, session server fn
  (getStartContext), root beforeLoad gate (open when auth env absent),
  /login page, signOut wired in topbar
- web: /runs/$runId — step cards with rule evidence, verdict/status chips,
  actions list; /rules — per-repo rule config CRUD (enabled toggle + validated
  json config), repo picker; nav entries
- contracts: per-rule config schemas + RULE_CATALOG (single source; core
  imports them)

Parent2400bdd