build(deps-dev): Bump @vitejs/plugin-react from 4.7.0 to 6.0.1 in /frontend

.env.example

@@ -0,0 +1,75 @@
+# Hermeschain — environment variables
+# Copy to .env and fill in for local dev.
+
+# ============= LLM =============
+ANTHROPIC_API_KEY=sk-ant-...
+HERMES_MODEL=claude-haiku-4-5-20251001
+LLM_PROVIDER=anthropic
+
+# ============= Database =============
+DATABASE_URL=postgresql://hermes:hermes@localhost:5432/hermeschain
+# Optional read replica (TASK-322)
+# READ_DATABASE_URL=postgresql://hermes:hermes@replica:5432/hermeschain
+# Pool tuning (TASK-319)
+PG_POOL_MAX=20
+PG_POOL_IDLE_MS=30000
+PG_POOL_CONNECT_MS=2000
+# Slow query threshold (TASK-321)
+PG_SLOW_QUERY_MS=1000
+
+# ============= Redis =============
+REDIS_URL=redis://localhost:6379
+# Cross-replica event bridge (TASK-330)
+REDIS_BRIDGE_ENABLED=true
+# Cache warmer at boot (TASK-328) — defaults true in production
+CACHE_WARMER_ENABLED=true
+
+# ============= Auth =============
+ADMIN_TOKEN=          # required to mint API keys
+# ADMIN_TOKEN_SECONDARY=  # set during rotation (TASK-346)
+
+# ============= Service role =============
+# 'web' or 'worker'
+AGENT_ROLE=web
+
+# ============= Worker =============
+AUTO_GIT_PUSH=true       # auto-push agent commits when GITHUB_TOKEN present
+GITHUB_TOKEN=ghp_...
+AGENT_REPO_ROOT=/path/to/repo
+
+# ============= Mesh =============
+HERMES_PEER_ID=
+HERMES_PUBLIC_URL=https://hermeschain.io
+HERMES_PUBLIC_KEY=
+# Comma-separated peer URLs to announce to on boot
+HERMES_BOOTSTRAP_PEERS=
+
+# ============= SSE =============
+# Set to 'false' on replicas that should NOT serve SSE (TASK-331)
+SSE_REPLICA=true
+
+# ============= Block production =============
+# Override default 10 OPEN reward (TASK-039)
+HERMES_BLOCK_REWARD_WEI=10000000000000000000
+
+# ============= API observability =============
+# Slow request log threshold (TASK-148)
+SLOW_REQUEST_MS=1000
+# Comma-separated CORS allowlist (TASK-145); empty = open
+CORS_ORIGINS=
+# JSON body size limit (TASK-340)
+JSON_BODY_LIMIT=1mb
+
+# ============= Backups (TASK-323/324) =============
+S3_BACKUP_BUCKET=
+S3_BACKUP_PREFIX=hermes-backups/
+AWS_REGION=us-east-1
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+BACKUP_RETAIN_DAYS=30
+RESTORE_DATABASE_URL=
+
+# ============= Build info (TASK-150) =============
+# Set by deploy pipeline; falls back to git rev-parse if absent
+HERMES_BUILD_COMMIT=
+HERMES_BUILD_TIME=

.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Something is broken
+labels: bug
+---
+
+## What happened
+
+<!-- A clear description of the bug -->
+
+## Expected behavior
+
+<!-- What you expected to happen -->
+
+## Reproduction
+
+1.
+2.
+3.
+
+## Environment
+
+- Hermeschain version / commit:
+- Node version:
+- OS:
+- Browser (if HUD-related):
+
+## Logs
+
+```
+<!-- Paste relevant log lines here -->
+```

.github/ISSUE_TEMPLATE/feature.md

@@ -0,0 +1,26 @@
+---
+name: Feature request
+about: Something you'd like Hermeschain to do
+labels: enhancement
+---
+
+## Problem
+
+<!-- What's the use case / pain point? -->
+
+## Proposed solution
+
+<!-- What should change -->
+
+## Alternatives considered
+
+<!-- Other approaches you ruled out, and why -->
+
+## Acceptance criteria
+
+- [ ]
+- [ ]
+
+## Linked task ID (if any)
+
+<!-- e.g. TASK-NNN from docs/backlog/queue/ -->

.github/ISSUE_TEMPLATE/security.md

@@ -0,0 +1,32 @@
+---
+name: Security report
+about: Security disclosures should usually go to the contact in security.txt instead
+labels: security
+---
+
+> **PRIVATE DISCLOSURE PREFERRED.** For sensitive vulnerabilities, please follow
+> the contact info in `frontend/public/.well-known/security.txt` rather than
+> opening a public issue.
+
+## Severity
+
+- [ ] Critical (RCE, key extraction, fund loss)
+- [ ] High (auth bypass, privilege escalation)
+- [ ] Medium (info disclosure, DoS)
+- [ ] Low (best practice violation)
+
+## What's the issue
+
+<!-- Describe the vulnerability without including a working exploit if possible -->
+
+## Reproduction
+
+<!-- Minimum steps to verify -->
+
+## Affected components
+
+- [ ] Backend / API
+- [ ] Frontend / HUD
+- [ ] Smart contracts (VM)
+- [ ] Agent worker / Git integration
+- [ ] Infrastructure / deploy

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+# PR
+
+## Summary
+
+<!-- 1-3 bullets on what changed and why -->
+
+-
+
+## Linked task IDs
+
+<!-- e.g. TASK-NNN, TASK-MMM from docs/backlog/queue/ -->
+
+-
+
+## Test plan
+
+- [ ] `npm run build` clean
+- [ ] `npm test` clean (or specific tests added/updated)
+- [ ] Manual verification step:
+
+## Risk / blast radius
+
+- [ ] Local-only / docs / no behavior change
+- [ ] Single endpoint or component
+- [ ] Cross-system (DB schema, mempool, consensus, fork-choice)
+- [ ] Public/external impact (visible URLs, message format breaking)
+
+## Rollback plan
+
+<!-- How to undo this if needed. For migrations, ensure -- down: works. -->

.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "backend"
+
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "frontend"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    labels:
+      - "ci"

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build-backend:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [20, 22]
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: hermes
+          POSTGRES_PASSWORD: hermes
+          POSTGRES_DB: hermeschain_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U hermes"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 5
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install
+        run: cd backend && npm ci || cd backend && npm install
+
+      - name: Build
+        run: cd backend && npm run build
+
+      - name: Test
+        env:
+          DATABASE_URL: postgresql://hermes:hermes@localhost:5432/hermeschain_test
+          REDIS_URL: redis://localhost:6379
+        run: cd backend && npm test
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+      - run: cd frontend && (npm ci || npm install)
+      - run: cd frontend && npm run build
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npx prettier --check .

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '47 6 * * 2'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      - name: Build (TypeScript)
+        run: |
+          cd backend
+          npm install
+          npm run build
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3

.github/workflows/npm-audit.yml

@@ -0,0 +1,27 @@
+name: npm audit
+
+on:
+  pull_request:
+  schedule:
+    - cron: '23 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        path: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: npm audit
+        run: |
+          cd ${{ matrix.path }}
+          npm audit --audit-level=high