feat: add atomic release operations and trusted PR dev

.github/CONTRIBUTING.md

@@ -17,17 +17,10 @@ Run the relevant checks locally when possible:
 ```bash
 bun run lint:frontend
 bun run lint:backend
-bun run build
-bun run test:coverage
-```
-
-Backend changes use the same checks from `backend/`:
-
-```bash
-cd backend
-bun run lint:backend
-bun run build
-bun run test:coverage
+bun run build:frontend
+bun run build:backend
+bun run test:frontend:coverage
+bun run test:backend:coverage
 ```
 
 Run focused tests while iterating, then run the applicable coverage suite before

.github/dependabot.yml

@@ -1,92 +1,92 @@
 version: 2
 
 updates:
-  - package-ecosystem: "bun"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Europe/Oslo"
-    open-pull-requests-limit: 5
-    labels:
-      - "type: dependencies"
-      - "area: frontend"
-    commit-message:
-      prefix: "deps"
-    ignore:
-      # TypeScript 7 is already used for builds through @typescript/native.
-      # Keep TypeScript 6 available for typescript-eslint's compiler API.
-      - dependency-name: "typescript"
-        update-types:
-          - "version-update:semver-major"
-    groups:
-      frontend-major:
-        patterns:
-          - "*"
-        update-types:
-          - "major"
-      frontend-minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
+    - package-ecosystem: "bun"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+          day: "monday"
+          time: "06:00"
+          timezone: "Europe/Oslo"
+      open-pull-requests-limit: 5
+      labels:
+          - "type: dependencies"
+          - "area: frontend"
+      commit-message:
+          prefix: "deps"
+      ignore:
+          # TypeScript 7 is already used for builds through @typescript/native.
+          # Keep TypeScript 6 available for typescript-eslint's compiler API.
+          - dependency-name: "typescript"
+            update-types:
+                - "version-update:semver-major"
+      groups:
+          frontend-major:
+              patterns:
+                  - "*"
+              update-types:
+                  - "major"
+          frontend-minor-and-patch:
+              patterns:
+                  - "*"
+              update-types:
+                  - "minor"
+                  - "patch"
 
-  - package-ecosystem: "bun"
-    directory: "/backend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:15"
-      timezone: "Europe/Oslo"
-    open-pull-requests-limit: 5
-    labels:
-      - "type: dependencies"
-      - "area: backend"
-    commit-message:
-      prefix: "deps"
-    ignore:
-      # TypeScript 7 is already used for builds through @typescript/native.
-      # Keep TypeScript 6 available for typescript-eslint's compiler API.
-      - dependency-name: "typescript"
-        update-types:
-          - "version-update:semver-major"
-    groups:
-      backend-major:
-        patterns:
-          - "*"
-        update-types:
-          - "major"
-      backend-minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
+    - package-ecosystem: "bun"
+      directory: "/backend"
+      schedule:
+          interval: "weekly"
+          day: "monday"
+          time: "06:15"
+          timezone: "Europe/Oslo"
+      open-pull-requests-limit: 5
+      labels:
+          - "type: dependencies"
+          - "area: backend"
+      commit-message:
+          prefix: "deps"
+      ignore:
+          # TypeScript 7 is already used for builds through @typescript/native.
+          # Keep TypeScript 6 available for typescript-eslint's compiler API.
+          - dependency-name: "typescript"
+            update-types:
+                - "version-update:semver-major"
+      groups:
+          backend-major:
+              patterns:
+                  - "*"
+              update-types:
+                  - "major"
+          backend-minor-and-patch:
+              patterns:
+                  - "*"
+              update-types:
+                  - "minor"
+                  - "patch"
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:30"
-      timezone: "Europe/Oslo"
-    open-pull-requests-limit: 4
-    labels:
-      - "type: dependencies"
-      - "area: ci"
-    commit-message:
-      prefix: "ci"
-    groups:
-      github-actions-major:
-        patterns:
-          - "*"
-        update-types:
-          - "major"
-      github-actions-minor-and-patch:
-        patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+          day: "monday"
+          time: "06:30"
+          timezone: "Europe/Oslo"
+      open-pull-requests-limit: 4
+      labels:
+          - "type: dependencies"
+          - "area: ci"
+      commit-message:
+          prefix: "ci"
+      groups:
+          github-actions-major:
+              patterns:
+                  - "*"
+              update-types:
+                  - "major"
+          github-actions-minor-and-patch:
+              patterns:
+                  - "*"
+              update-types:
+                  - "minor"
+                  - "patch"

.github/pull_request_template.md

@@ -11,11 +11,11 @@
 <!-- Check everything you ran. Leave unchecked with a short reason if not applicable. -->
 
 - [ ] Frontend lint: `bun run lint:frontend`
-- [ ] Frontend build: `bun run build`
-- [ ] Frontend tests/coverage: `bun run test:coverage`
+- [ ] Frontend build: `bun run build:frontend`
+- [ ] Frontend tests/coverage: `bun run test:frontend:coverage`
 - [ ] Backend lint: `bun run lint:backend`
-- [ ] Backend build: `bun run build` from `backend/`
-- [ ] Backend tests/coverage: `bun run test:coverage` from `backend/`
+- [ ] Backend build: `bun run build:backend`
+- [ ] Backend tests/coverage: `bun run test:backend:coverage`
 - [ ] Focused regression tests: <!-- command(s) -->
 - [ ] Manual UI/API smoke check, if relevant
 

.github/workflows/dashboard-checks.yml

@@ -38,10 +38,10 @@ jobs:
               run: bun run lint:frontend
 
             - name: Build frontend
-              run: bun run build
+              run: bun run build:frontend
 
             - name: Test frontend coverage
-              run: bun run test:coverage
+              run: bun run test:frontend:coverage
 
             - name: Upload frontend coverage artifact
               uses: actions/upload-artifact@v7
@@ -92,12 +92,10 @@ jobs:
               run: bun run lint:backend
 
             - name: Build backend
-              run: bun run build
-              working-directory: backend
+              run: bun run build:backend
 
             - name: Test backend coverage
-              run: bun run test:coverage
-              working-directory: backend
+              run: bun run test:backend:coverage
 
             - name: Prefix backend LCOV paths
               if: always()

.gitignore

@@ -10,6 +10,7 @@ lerna-debug.log*
 .env.local
 
 node_modules
+.eslintcache
 dist
 release-manifest.json
 backend/data/

.prettierignore

@@ -1,4 +1,8 @@
+.eslintcache
+backend/data
+coverage
+data
 dist
 node_modules
 *.min.js
-*.min.css
+*.min.css

README.md

@@ -52,23 +52,33 @@ bun install
 Install backend dependencies separately:
 
 ```bash
-cd backend
-bun install
+bun --cwd backend install
 ```
 
-Run the frontend dev server:
+Run the complete local dev stack:
 
 ```bash
 bun run dev
 ```
 
-Run the backend dev server from `backend/`:
+For WebAuthn and access from another Tailscale device, use the HTTPS route:
 
 ```bash
-bun run dev
+bun run dev:remote
 ```
 
-The backend scripts use Doppler (`rajohan` / `prd`) for runtime secrets. Do not commit `.environment` files, tokens, database dumps, or generated runtime state.
+Both commands start frontend and backend hot reload, React Compiler, an isolated
+Dashboard database/workspace snapshot, and a dev-only scheduler/worker. Dev
+connects to the live OpenClaw Gateway, so chat and session changes can affect
+production data. Production host, backup, config, cron, destructive session,
+and PR actions remain blocked.
+
+Only the Gateway token, production auth timing values, and non-secret WebAuthn
+RP ID are selected from Doppler (`rajohan` / `prd`) at runtime. The RP ID is
+used to discard incompatible copied WebAuthn credentials for local development.
+No secret values are stored in scripts or tracked files. See
+[Local development](docs/development/local-dev.md) for state paths, reset
+commands, and the trusted PR-dev flow.
 
 ## Verification commands
 
@@ -78,18 +88,10 @@ From the repo root:
 bun run lint:frontend
 bun run lint:backend
 bun run build
-bun run test
-bun run test:coverage
-bun run format:check
-```
-
-From `backend/`:
-
-```bash
-bun run lint:backend
-bun run build
-bun run test
-bun run test:coverage
+bun run test:frontend
+bun run test:backend
+bun run test:frontend:coverage
+bun run test:backend:coverage
 bun run format:check
 ```
 
@@ -119,7 +121,8 @@ CI and local verification.
   restrictive storage modes, deploy/maintenance snapshots, and automated
   restore checks.
 - Frontend builds and the local frontend dev server use Bun's HTML bundler with Babel React Compiler and Bun Tailwind plugins.
-- Dev server listens on all addresses so the dashboard can be reached over Tailscale when needed.
+- Dev servers bind to loopback. `bun run dev:remote` publishes the frontend
+  through an explicit Tailscale Serve HTTPS route.
 - Auth is enforced by the backend request policy for every API route except
   `GET|HEAD /api/health/live`, `GET|HEAD /api/health/ready`,
   `GET|HEAD /api/auth/bootstrap`,