feat(cli): add unified potpie atlassian login flow (2/2)

.github/CONTRIBUTING.md

@@ -36,7 +36,7 @@ If you’re unsure about how to get started, feel free to browse our issues labe
 Ensure you have the following software installed:
 
 - [Git](https://git-scm.com/)
-- [Python 3.11+](https://www.python.org/)
+- [Python 3.12+](https://www.python.org/)
 - [uv](https://docs.astral.sh/uv/) - Fast Python package installer (install via `curl -LsSf https://astral.sh/uv/install.sh | sh`)
 - [Docker](https://www.docker.com/) (if applicable)
 

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -75,7 +75,7 @@ body:
         - uv version
         - Any relevant environment variables (sanitize sensitive data)
       placeholder: |
-        Python: 3.11.5
+        Python: 3.12.5
         Docker: 24.0.0
         uv: 0.1.0
         ENV: development

.github/workflows/test.yml

@@ -12,7 +12,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.12", "3.13"]
 
     steps:
       - name: Checkout
@@ -45,7 +45,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.12", "3.13"]
     services:
       postgres:
         image: postgres:15
@@ -99,7 +99,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.12", "3.13"]
 
     steps:
       - name: Checkout

.gitignore

@@ -3,13 +3,13 @@
 *__pycache__
 .potpie/
 .venv
+.tmp/
 firebase_service_account.json
 firebase_service_account.json:Zone.Identifier
 cli/dist
 cli/.venv
 venv/
 .env
-*.json
 !seed/data/**/*.json
 !potpie/context-engine/benchmarks/data/**/*.json
 !potpie/context-engine/tests/data/**/*.json
@@ -115,3 +115,4 @@ target
 seed/.state/
 
 .omo
+.prsplit

Makefile

@@ -0,0 +1,78 @@
+# Potpie root Makefile
+#
+# Installs the local `potpie` context-engine CLI globally. The day-to-day dev
+# stack (infra, API, worker, migrations, tests) lives in legacy/Makefile — run
+# those with `make -C legacy <target>`.
+#
+# Quick start:
+#   make cli-install   # build graph-explorer UI + install potpie on your PATH (editable)
+#   make cli-status    # confirm the install is healthy
+#   make help          # list all targets
+
+SHELL := /bin/bash
+.SHELLFLAGS := -eu -o pipefail -c
+
+.DEFAULT_GOAL := help
+.PHONY: help ui-build cli-install cli-update cli-uninstall cli-status
+
+##@ Help
+
+help: ## Show this help
+	@awk 'BEGIN {FS = ":.*?## "} \
+	     /^##@ / {sub(/^##@ /, ""); printf "\n\033[1m%s\033[0m\n", $$0; next} \
+	     /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}' \
+	     $(MAKEFILE_LIST)
+
+##@ Context Engine CLI (potpie)
+
+# The `potpie` CLI lives in $(CE_DIR) and installs as a uv tool in EDITABLE mode:
+# the global `potpie` / `potpie-mcp` on your PATH run straight from the repo
+# source, so code changes — including the in-process daemon — are live on the
+# next invocation with no reinstall. The CLI also auto-loads this repo's .env
+# (Neo4j/Postgres creds) regardless of which directory you run it from, so a
+# global `potpie` reaches your local backends out of the box. Re-run
+# `make cli-install` only when dependencies or entry points change.
+CE_DIR := potpie/context-engine
+UI_FRONTEND_DIR := $(CE_DIR)/adapters/inbound/http/ui/frontend
+CLI_TOOL := potpie-context-engine
+CLI_PYTHON ?= >=3.12,<3.14
+
+ui-build: ## Build the graph-explorer SPA (npm install + vite) into frontend/dist
+	@command -v npm >/dev/null 2>&1 || { echo "❌ npm not installed — see https://nodejs.org/"; exit 1; }
+	cd $(UI_FRONTEND_DIR) && npm install && npm run build
+
+cli-install: ui-build ## Install potpie + potpie-mcp globally (editable, all extras). Re-run after dep/entrypoint changes.
+	@command -v uv >/dev/null 2>&1 || { echo "❌ uv not installed — see https://docs.astral.sh/uv/"; exit 1; }
+	@# Drop the pre-rename "context-engine" tool if a stale copy is lingering.
+	-@uv tool uninstall context-engine >/dev/null 2>&1 || true
+	@# Stop any old detached daemon before replacing the tool env; otherwise the
+	@# fresh CLI can still talk to a daemon running the previous Python/backend.
+	-@if command -v potpie >/dev/null 2>&1; then potpie daemon stop >/dev/null 2>&1; fi
+	uv tool install --python '$(CLI_PYTHON)' --force --editable "./$(CE_DIR)[all]"
+	@case ":$$PATH:" in \
+	  *":$$HOME/.local/bin:"*) echo "✓ potpie installed (editable). Try: potpie --help";; \
+	  *) echo "✓ installed, but $$HOME/.local/bin is not on PATH — run: uv tool update-shell, then restart your shell";; \
+	esac
+
+cli-update: cli-install ## Refresh the global install (alias for cli-install; code is already live via editable mode)
+
+cli-uninstall: ## Remove the global potpie CLI
+	-@if command -v potpie >/dev/null 2>&1; then potpie daemon stop >/dev/null 2>&1; fi
+	-uv tool uninstall $(CLI_TOOL)
+	-@uv tool uninstall context-engine >/dev/null 2>&1 || true
+
+cli-status: ## Show the global potpie install + run a quick health check
+	@uv tool list 2>/dev/null | grep -A2 '^$(CLI_TOOL)' || echo "$(CLI_TOOL): not installed (run: make cli-install)"
+	@printf 'on PATH:  '; command -v potpie || echo "potpie NOT on PATH"
+	@if command -v potpie >/dev/null 2>&1; then \
+	  py="$$(head -n 1 "$$(command -v potpie)" | sed 's/^#!//')"; \
+	  printf 'python:   '; "$$py" --version; \
+	else \
+	  echo "python:   unknown"; \
+	fi
+	@potpie --help >/dev/null 2>&1 && echo "health:   ✓ potpie runs current source" || echo "health:   ✗ potpie failed (run: make cli-install)"
+	@if [ -f "$(UI_FRONTEND_DIR)/dist/index.html" ]; then \
+	  echo "ui:       ✓ graph explorer built ($(UI_FRONTEND_DIR)/dist)"; \
+	else \
+	  echo "ui:       ✗ not built (run: make ui-build)"; \
+	fi

README.md

@@ -35,7 +35,7 @@
 
 - [Docker](https://docker.com) installed and running
 - [Git](https://git-scm.com) installed
-- [Python 3.11+](https://python.org) with [uv](https://docs.astral.sh/uv/)
+- [Python 3.12+](https://python.org) with [uv](https://docs.astral.sh/uv/)
 
 ### Installation
 

docs/context-graph/architecture.md

@@ -209,7 +209,7 @@ daemon-hosted orchestrator → render the `SetupReport`.
 class SetupPlan:
     mode: str = "local"        # local setup; managed auth uses LoginPlan
     host_mode: str = "daemon"  # daemon | in_process
-    backend: str = default_setup_backend()  # falkordb_lite on Python >=3.12, else embedded
+    backend: str = default_setup_backend()  # falkordb_lite
     repo: str | None = "."
     pot: str = "default"
     agent: str = "claude"

docs/context-graph/cli-flow.md

@@ -350,7 +350,9 @@ skills directory:
 | Codex | `$HOME/.agents/skills/<skill>/SKILL.md` |
 
 Use `--scope project --path .` when a repo-local install should be committed or
-shared with the repository.
+shared with the repository. Instruction files such as `AGENTS.md` and
+`CLAUDE.md` are merged through Potpie managed blocks; existing user-authored
+content is preserved and Potpie only appends or updates its marked section.
 
 ## Output Contract
 

docs/context-graph/issue-candidates.md

@@ -204,7 +204,7 @@ Recommendation: file **A + B + C ≈ 22 issues**; keep C′ as PR-description ch
 ### 20. chore(deps): verify redis>=7.1,<8 upper bound and python_version markers, and confirm potpie-daemon script entry resolves
 
 - **PR:** `cg-05`  ·  **Category:** tech-debt  ·  **Risk:** 🟠 med  ·  follow-up
-- **Why:** cg-05 promotes falkordblite>=0.10.0 (python_version >= '3.12') and redis>=7.1,<8 from extras into default deps, so every CLI install on py3.12+ pulls FalkorDBLite + redis (the <8 bound exists because redis 8 maintenance notifications break FalkorDBLite's hostless embedded connection). Confirm the redis<8 bound and that the python_version markers keep resolution valid across the project's wider requires-python. Also confirm the potpie-daemon = 'host.daemon_main:main' script entry resolves — verified the module exists on this tip, but in an intermediate cg-05-only install (before cg-08) it may dangle, so gate/verify it doesn't expose a broken console script.
+- **Why:** cg-05 promotes falkordblite>=0.10.0 and redis>=7.1,<8 from extras into default deps, so every CLI install pulls FalkorDBLite + redis (the <8 bound exists because redis 8 maintenance notifications break FalkorDBLite's hostless embedded connection). Confirm the redis<8 bound and that the Python 3.12+ support floor is reflected in package metadata. Also confirm the potpie-daemon = 'host.daemon_main:main' script entry resolves — verified the module exists on this tip, but in an intermediate cg-05-only install (before cg-08) it may dangle, so gate/verify it doesn't expose a broken console script.
 - **Source:** pyproject.toml:23-26 (redis/falkordblite), :89 (potpie-daemon) + .prsplit/feat__cg-05-ce-backends.md Review focus 'Dependency surface'
 
 ### 21. chore(ce): apply_plan rename + writer-port seam has no dangling old-name imports and all writers satisfy the port

docs/context-graph/pr-split-plan.md

@@ -173,7 +173,7 @@ assert_playbook_vocabulary_coherence heuristic guard (scans registered playbook
 ### PR-10 — chore(domain): setup-backend defaults + minor port doc/signature touches
 **type:** chore · **size:** S · **depends on:** PR-1
 
-lifecycle.default_setup_backend() (falkordb_lite on py>=3.12 else embedded) + SetupPlan defaults (backend factory, pot 'foo-pot'->'default'), ports/settings doc tweak, ports/graph/backend profile-list (falkordb_lite/embedded/falkordb), SourceInfo.location, skill_manager uninstall all_/optional skill_id, and the cosmetic-only domain/ports/daemon cleanup (em-dash, import ordering, comment removal — zero behavior change).
+lifecycle.default_setup_backend() (falkordb_lite) + SetupPlan defaults (backend factory, pot 'foo-pot'->'default'), ports/settings doc tweak, ports/graph/backend profile-list (falkordb_lite/embedded/falkordb), SourceInfo.location, skill_manager uninstall all_/optional skill_id, and the cosmetic-only domain/ports/daemon cleanup (em-dash, import ordering, comment removal — zero behavior change).
 
 **Files / areas:**
 - `potpie/context-engine/domain/lifecycle.py`

docs/telemetry/sentry.md

@@ -2,7 +2,7 @@
 
 Sentry is used only for unexpected Potpie context-engine CLI failures. It is a
 small CLI-owned integration under `potpie/context-engine`, independent of
-`potpie/observability` and `legacy/deploy/observability`.
+the context-engine telemetry path and `legacy/deploy/observability`.
 
 ## Configuration
 

legacy/README.md

@@ -2,7 +2,7 @@
 
 This folder contains the original Potpie monolith: FastAPI app, agents, Celery workers, seed CLI, deployment assets, and regression tests.
 
-Core libraries live at the repo root under `potpie/` (`context-engine`, `parsing`, `sandbox`, `integrations`, `observability`). You can delete this entire `legacy/` directory if you only need those packages.
+Core libraries live at the repo root under `potpie/` (`context-engine`, `parsing`, `sandbox`, `integrations`). You can delete this entire `legacy/` directory if you only need those packages.
 
 ## Quick start
 

legacy/app/modules/context_graph/tasks.py

@@ -107,8 +107,8 @@ def context_graph_apply_episode(
     queue="context-graph-etl",
 )
 def context_graph_sync_linear_project_source(self, project_source_id: str) -> dict:
-    from integrations.adapters.outbound.linear.linear_sync import (
-        sync_linear_project_source,
-    )
-
-    return sync_linear_project_source(self.db, project_source_id)
+    return {
+        "status": "skipped",
+        "reason": "linear_sync_removed",
+        "project_source_id": project_source_id,
+    }

legacy/deploy/observability/README.md

@@ -1,13 +1,13 @@
 # Observability deployment — Loki + Promtail + Grafana
 
-This is the production log-aggregation pipeline for the [observability
-package](../../potpie/observability). Closes the audit's
+This is the production log-aggregation pipeline for legacy JSONL application
+logs. Closes the audit's
 "JSONL-to-stdout-is-inert-without-a-shipper" gap.
 
 ## What it does
 
 1. The FastAPI and Celery containers emit one JSON object per line to stdout
-   (the `json_stdout` sink in the observability package).
+   (the legacy JSONL logging sink).
 2. **Promtail** tails Docker container logs, parses the JSON, and ships each
    line to Loki with `level` as a label and the structured fields
    (`request_id`, `conversation_id`, `run_id`, `user_id`, `task_id`,
@@ -64,7 +64,7 @@ on; structured metadata is high-cardinality fields you may search/extract**.
 - **Structured metadata** (unbounded values): `request_id`, `conversation_id`,
   `run_id`, `user_id`, `task_id`, `project_id`, `logger`
 
-This matches the observability package's design: high-cardinality
+This matches the logging design: high-cardinality
 correlation IDs go in `obs_context` / `obs_fields`, are flattened into the
 JSON output, and Promtail promotes them to structured metadata without
 turning them into labels.

legacy/deploy/observability/docker-compose.observability.yml

@@ -1,4 +1,4 @@
-# Log aggregation + dashboard stack for the observability package's prod JSONL output.
+# Log aggregation + dashboard stack for the legacy app's prod JSONL output.
 #
 # What this gives you:
 # - Loki         on :3100  — stores JSONL log lines from FastAPI + Celery

legacy/deploy/observability/grafana-datasources.yaml

@@ -12,7 +12,7 @@ datasources:
       maxLines: 5000
       derivedFields:
         # Click-through from a log line to the trace it belongs to (logfire /
-        # OTel emit a trace_id; the observability package puts it in
+        # OTel emit a trace_id; legacy logging puts it in
         # obs_context when present).
         - name: trace_id
           matcherRegex: "\"trace_id\"\\s*:\\s*\"([a-f0-9]+)\""

legacy/deploy/observability/promtail-config.yaml

@@ -1,7 +1,7 @@
 # Promtail config: tail Docker container stdout/stderr, parse our JSONL log
 # lines into labels Loki/Grafana can query.
 #
-# The observability package emits one JSON object per line to stdout with at
+# The legacy app emits one JSON object per line to stdout with at
 # least these keys: timestamp, level, logger, function, line, message — plus
 # any flattened obs_fields / obs_context (request_id, conversation_id, user_id,
 # task_id, run_id, ...).

legacy/deployment/prod/celery/celery.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project

legacy/deployment/prod/convo-server/convo.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project

legacy/deployment/prod/mom-api/api.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project

legacy/deployment/stage/celery/celery.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project

legacy/deployment/stage/convo-server/convo.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project

legacy/deployment/stage/mom-api/api.Dockerfile

@@ -1,5 +1,5 @@
 # Use an official Python runtime as a parent image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y git procps supervisor curl ca-certificates build-essential && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,6 @@ COPY potpie/context-engine ./potpie/context-engine
 COPY potpie/integrations ./potpie/integrations
 COPY potpie/parsing ./potpie/parsing
 COPY potpie/sandbox ./potpie/sandbox
-COPY potpie/observability ./potpie/observability
 
 # Install dependency layers first, including the local Rust extension
 RUN uv sync --frozen --all-packages --no-install-project