Add audited self-hosted platform and retain Local workflows

.dockerignore

@@ -0,0 +1,24 @@
+.git
+.env*
+.local
+upstream.json
+upstream-overrides.json
+scripts/check-upstream.py
+.data
+local
+node_modules
+**/node_modules
+e2e/test-results
+bin
+*.log
+
+!web/vscode-web/**/node_modules/
+!web/vscode-web/**
+
+# Local acceptance credentials and generated reports never enter build layers.
+e2e/.auth
+e2e/playwright-report
+e2e/test-results
+**/__pycache__
+**/.venv
+**/*.pyc

.env.example

@@ -0,0 +1,15 @@
+# Run bash scripts/configure.sh to generate unique local database/session secrets.
+AGENTFLOW_HTTP_PORT=8090
+AGENTFLOW_MYSQL_DSN=loopforge:REPLACE_ME@tcp(127.0.0.1:33315)/loopforge
+AGENTFLOW_SESSION_SECRET=REPLACE_WITH_64_RANDOM_HEX_CHARACTERS
+AGENTFLOW_AUTH_REQUIRED=true
+LOOPFORGE_DB_PASSWORD=REPLACE_ME
+LOOPFORGE_DB_ROOT_PASSWORD=REPLACE_ME
+LOOPFORGE_MYSQL_PORT=33315
+# Optional public address reachable from execution containers/runners:
+AGENTFLOW_PLATFORM_MCP_URL=
+# Optional model IDs available to your CodeBuddy account (comma-separated):
+AGENTFLOW_ASSISTANT_MODELS=
+AGENTFLOW_ASSISTANT_MODEL=
+# Worker separation, installed runners and preview settings retain AGENTFLOW_ names.
+# See docs/deployment.md. Production HTTPS: AGENTFLOW_SECURE_COOKIES=true.

.gitattributes

@@ -0,0 +1,2 @@
+web/monaco/** linguist-vendored -whitespace
+web/vscode-web/** linguist-vendored -whitespace

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,30 +10,34 @@ body:
   - type: dropdown
     id: host
     attributes:
-      label: Host
+      label: Component / host
       options:
-        - CodeBuddy
-        - Codex
-        - Cursor
-        - Claude Code
-        - Installer / CLI
+        - Platform — web / API
+        - Platform — runner / sandbox
+        - Platform — deployment
+        - Local — CodeBuddy
+        - Local — Codex
+        - Local — Cursor
+        - Local — Claude Code
+        - Local — installer / CLI
     validations:
       required: true
   - type: dropdown
     id: edition
     attributes:
       label: Edition
       options:
-        - Classic
-        - Portable
+        - Platform
+        - Local Classic
+        - Local Portable
         - Not sure
     validations:
       required: true
   - type: input
     id: version
     attributes:
       label: LoopForge version
-      placeholder: "0.1.0"
+      placeholder: "Platform commit SHA or Local package version"
     validations:
       required: true
   - type: textarea
@@ -58,7 +62,7 @@ body:
     id: diagnostics
     attributes:
       label: Sanitized diagnostics
-      description: Include relevant `loopforge doctor` output and errors after removing sensitive data.
+      description: Include browser errors, deployment steps, or Local `loopforge doctor` output, with secrets removed.
       render: shell
   - type: checkboxes
     id: checks

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -22,9 +22,12 @@ body:
     attributes:
       label: Scope
       options:
+        - Platform — workflows / collaboration
+        - Platform — UI / integrations
+        - Platform — runtime / deployment
         - Shared behavior contract
-        - Classic edition
-        - Portable edition
+        - Local Classic edition
+        - Local Portable edition
         - Installer / CLI
         - Documentation
         - Not sure

.github/dependabot.yml

@@ -22,7 +22,7 @@ updates:
 
   # npm dependencies — only minor and patch updates.
   - package-ecosystem: npm
-    directory: /
+    directory: /local
     schedule:
       interval: monthly
     cooldown:
@@ -44,7 +44,7 @@ updates:
 
   # pip dependencies — only minor and patch updates.
   - package-ecosystem: pip
-    directory: /
+    directory: /local
     schedule:
       interval: monthly
     cooldown:
@@ -59,3 +59,14 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - dependencies
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /e2e
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3

.github/pull_request_template.md

@@ -4,6 +4,8 @@ Describe the user problem and the resulting behavior.
 
 ## Scope
 
+- [ ] Platform core / API / runner
+- [ ] Public adapter / deployment
 - [ ] Classic
 - [ ] Portable
 - [ ] Shared behavior contract
@@ -19,9 +21,12 @@ List affected hosts and any migration or backward-compatibility impact.
 List commands that were actually run and mark anything blocked or not run.
 
 ```text
-bash scripts/validate.sh
-bash scripts/smoke-install.sh
-bash scripts/e2e.sh
+go test -p=2 ./... -count=1 -timeout=180s
+go vet ./...
+python3 scripts/check-public.py
+bash local/scripts/validate.sh
+bash local/scripts/smoke-install.sh
+bash local/scripts/e2e.sh
 bash scripts/scan-secrets.sh
 ```
 

.github/repository-metadata.json

@@ -0,0 +1,92 @@
+{
+  "description": "Turn requirements into reviewed delivery: reusable agent workflows, coding agents, scripts and human approvals. Self-hosted. MIT.",
+  "topics": [
+    "ai-agents",
+    "multi-agent",
+    "agentic-workflow",
+    "sop",
+    "workflow-automation",
+    "software-engineering",
+    "human-in-the-loop",
+    "self-hosted",
+    "codex",
+    "claude-code",
+    "codebuddy",
+    "mcp",
+    "agent-skills",
+    "golang",
+    "developer-tools"
+  ],
+  "labels": [
+    {
+      "name": "bug",
+      "color": "d73a4a",
+      "description": "A reproducible product defect"
+    },
+    {
+      "name": "enhancement",
+      "color": "a2eeef",
+      "description": "A feature or improvement"
+    },
+    {
+      "name": "needs-triage",
+      "color": "fbca04",
+      "description": "Awaiting maintainer classification"
+    },
+    {
+      "name": "area:platform",
+      "color": "1d76db",
+      "description": "Platform UI, API and workflow behavior"
+    },
+    {
+      "name": "area:runtime",
+      "color": "5319e7",
+      "description": "Engine, worker, runner and sandbox execution"
+    },
+    {
+      "name": "area:local",
+      "color": "0e8a16",
+      "description": "Local workflows and host integrations"
+    },
+    {
+      "name": "area:integrations",
+      "color": "006b75",
+      "description": "GitHub, MCP, model providers and knowledge"
+    },
+    {
+      "name": "documentation",
+      "color": "0075ca",
+      "description": "Documentation, examples and translations"
+    },
+    {
+      "name": "dependencies",
+      "color": "0366d6",
+      "description": "Dependency and security updates"
+    },
+    {
+      "name": "github-actions",
+      "color": "000000",
+      "description": "CI and automation"
+    },
+    {
+      "name": "good first issue",
+      "color": "7057ff",
+      "description": "A scoped task suitable for a first contribution"
+    },
+    {
+      "name": "help wanted",
+      "color": "008672",
+      "description": "Maintainers welcome community help"
+    },
+    {
+      "name": "sync:upstream",
+      "color": "c5def5",
+      "description": "Shared change should be ported to internal upstream"
+    },
+    {
+      "name": "public-only",
+      "color": "bfdadc",
+      "description": "Public adapter, packaging or public documentation"
+    }
+  ]
+}

.github/workflows/e2e.yml

@@ -12,6 +12,10 @@ concurrency:
   group: e2e-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    working-directory: local
+
 jobs:
   e2e:
     name: e2e (${{ matrix.os }}, python ${{ matrix.python-version }}, node ${{ matrix.node-version }})
@@ -51,7 +55,7 @@ jobs:
           node-version: "22"
       - name: Install Playwright
         run: |
-          python3 -m pip install pyyaml==6.0.3 playwright==1.63.0
+          python3 -m pip install pyyaml==6.0.3 playwright==1.55.0
           python3 -m playwright install --with-deps chromium
       - name: Render the observability dashboard
         env:
@@ -74,6 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Require every E2E job to pass
+        working-directory: ${{ runner.temp }}
         run: |
           if [[ "${{ needs.e2e.result }}" != "success" || "${{ needs.e2e-browser.result }}" != "success" ]]; then
             echo "e2e=${{ needs.e2e.result }} e2e-browser=${{ needs.e2e-browser.result }}" >&2