Phase 1a–1c: Dioxus fullstack open-source health dashboard (PRs, Devin workbench, Releases, CI)

.env.example

@@ -0,0 +1,33 @@
+# Every credential below is also read from a DIOXUS_STATUS_-prefixed name
+# (e.g. DIOXUS_STATUS_DEVIN_API_KEY), matching the org-level Devin secrets.
+
+# GitHub token with read access to the DioxusLabs org (public repos is enough)
+GITHUB_TOKEN=
+
+# GitHub App auth (preferred over GITHUB_TOKEN when the app is installed).
+# Provide the PEM either inline (literal \n allowed) or via path.
+GITHUB_APP_ID=
+GITHUB_APP_PRIVATE_KEY=
+GITHUB_APP_PRIVATE_KEY_PATH=
+# Optional: skip installation discovery (otherwise /app/installations is searched for the org)
+GITHUB_APP_INSTALLATION_ID=
+
+# Shared secret for admin mutations via /settings login
+ADMIN_TOKEN=
+
+# Devin API (v3, org-scoped)
+DEVIN_API_KEY=
+DEVIN_ORG_ID=
+DEVIN_API_BASE=https://api.devin.ai
+
+# Optional: Anthropic (later phases)
+ANTHROPIC_API_KEY=
+
+# SQLite data directory
+DATA_DIR=./_data
+
+# Port (also settable by dx serve --port)
+PORT=8080
+
+# Daily cap on LLM assessment calls
+LLM_DAILY_BUDGET=50

.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: ci
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy -p dioxus-status --features server --profile server-dev --target x86_64-unknown-linux-gnu -- -D warnings
+      - run: cargo clippy -p dioxus-status --features web --target wasm32-unknown-unknown --profile wasm-dev -- -D warnings
+      - run: cargo test -p dioxus-status --features server --profile server-dev --target x86_64-unknown-linux-gnu

.gitignore

@@ -1 +1,4 @@
 /target
+**/dist
+_data/
+.env

ARCHITECTURE.md

@@ -0,0 +1,46 @@
+# Architecture (implementation notes)
+
+Single Dioxus 0.8 fullstack crate, modelled on `skyvm-web` (see /home/ubuntu/repos/skyvm/packages/skyvm-web).
+
+```
+Cargo.toml                      workspace: packages/status, vendor/*
+packages/status/
+  Cargo.toml                    name = "dioxus-status"; features web / server
+  Dioxus.toml
+  assets/                       main.css, dx-components-theme.css (from dioxus-components 0.8 branch)
+  src/
+    main.rs                     Route enum, App, launch; server: init db + start collectors
+    components/                 vendored styled components from dioxus-components (button, badge, card,
+                                input, select, tabs, dialog, tooltip, checkbox, switch, progress, separator,
+                                dropdown_menu, toast, table-ish)  — copied from preview/src/components
+    model/                      shared serde types (Pr, Issue, Repo, Score, Assessment, CrateStats, ...)
+    api/                        server fns: #[get]/#[post]; the only client<->server boundary
+    backend/  (cfg server)      db.rs (sqlx sqlite + migrations/), github.rs (octocrab GraphQL/REST),
+                                crates_io.rs, scoring.rs, collector.rs (scheduler), devin.rs, anthropic.rs,
+                                auth.rs (admin session cookie / github oauth)
+    ui/                         pages + shared layout
+vendor/
+  dioxus-primitives/            copied from DioxusLabs/dioxus-components branch 0.8 (primitives/)
+  dioxus-attributes/            same repo (dioxus-attributes/)
+migrations/                     sqlx sql migrations
+Dockerfile, fly.toml
+```
+
+Build notes: `dx` uses `--profile server-dev` (host, `--target x86_64-unknown-linux-gnu`) and
+`--profile wasm-dev` (wasm32); both are declared in the workspace `Cargo.toml` (inherit `dev`) so
+plain cargo shares dx's artifact dirs — see README "Development" for the canonical check/clippy/test
+commands. `cargo test` is the exception: the `dioxus-ssr` dev-dep changes feature resolution, so it
+builds its own dep tree once per profile dir.
+
+Env vars: `GITHUB_TOKEN` (fallback), `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY` or `GITHUB_APP_PRIVATE_KEY_PATH`,
+`GITHUB_APP_INSTALLATION_ID` (optional; discovered via `/app/installations`), `DEVIN_API_KEY`, `DEVIN_ORG_ID`,
+`DEVIN_API_BASE` (default https://api.devin.ai; calls go to `{base}/v3/organizations/{org}/sessions`), `ANTHROPIC_API_KEY`,
+`LLM_DAILY_BUDGET` (default 50; overridable via `settings.llm_daily_budget`),
+`ADMIN_TOKEN` (shared secret for mutation auth in v1), `DATA_DIR` (default `./_data`), `PORT`.
+
+Auth model: all pages public. Mutations (settings changes, dispatch Devin, assess with LLM, roadmap admin) require an
+admin session (cookie set by `/settings` login with `ADMIN_TOKEN`; GitHub OAuth org-member login is the follow-up).
+Public voting on roadmap items needs no auth (anonymous voter id cookie + rate limit).
+
+LLM policy: never called in background. Only the explicit "Assess" action calls Anthropic, result cached per
+(pr, head_sha); daily cap `LLM_DAILY_BUDGET` (default 50 calls).