merge: resolve conflicts with main, fix prime.md tool names

Co-authored-by: MarkusNeusinger <2921697+MarkusNeusinger@users.noreply.github.com>

Author: Copilot

.env.example

@@ -35,6 +35,28 @@ ENVIRONMENT=development
 # API port (default: 8000)
 PORT=8000
 
+# ============================================================================
+# Admin Auth (for /debug/* endpoints)
+# ============================================================================
+
+# GET /debug/status and GET /debug/ping can be authorized either by a valid
+# Cloudflare Access JWT (production browser flow) or by ADMIN_TOKEN.
+# Leave ADMIN_TOKEN unset if you only want Cloudflare Access auth.
+# Set it for local development, CI, or as a break-glass fallback when
+# Cloudflare Access is unavailable. Locally, any non-empty string works
+# because these endpoints are only reachable on localhost.
+# ADMIN_TOKEN=
+
+# Cloudflare Access (Zero Trust) settings — only needed when verifying the
+# Cf-Access-Jwt-Assertion header in production. Leave unset locally.
+# CF_ACCESS_TEAM_DOMAIN=anyplot.cloudflareaccess.com
+# CF_ACCESS_AUD=
+
+# Comma-separated list of allowed Google account email addresses for the
+# Cloudflare Access JWT path. Required for the JWT path to authorize anyone;
+# requests with a valid JWT but an unlisted email return 403.
+# ADMIN_ALLOWED_EMAILS=alice@example.com,bob@example.com
+
 # ============================================================================
 # AI Services (optional)
 # ============================================================================

.github/copilot-instructions.md

@@ -4,7 +4,6 @@ This file provides guidance to GitHub Copilot when working with code in this rep
 
 ## Important Rules
 
-- **No Co-authored-by in commit messages** - Never add `Co-authored-by:` lines to commit messages. Keep commit messages clean without AI attribution footers.
 - **Always write in English** - All output text (code comments, commit messages, PR descriptions, issue comments, documentation) must be in English, even if the user writes in another language.
 
 ## Task Suitability
@@ -85,17 +84,22 @@ Everything for one plot type lives in a single directory:
 
 ```
 plots/{spec-id}/
-├── specification.md     # Library-agnostic description
-├── specification.yaml   # Tags, created, issue, suggested
-├── metadata/            # Per-library metadata
-│   ├── matplotlib.yaml
-│   └── ...
-└── implementations/     # Library implementations
-    ├── matplotlib.py
-    ├── seaborn.py
-    └── ...
+├── specification.md             # Library-agnostic description
+├── specification.yaml           # Tags, created, issue, suggested
+├── metadata/
+│   └── python/                  # Per-library metadata (one file per library)
+│       ├── matplotlib.yaml
+│       ├── seaborn.yaml
+│       └── ...
+└── implementations/
+    └── python/                  # Library implementations (one file per library)
+        ├── matplotlib.py
+        ├── seaborn.py
+        └── ...
 ```
 
+The `python/` subdirectory is a deliberate forward-compatibility layer; non-Python implementation languages would live as siblings (e.g. `implementations/r/`) when introduced. All paths in code, prompts, and metadata refer to the language-prefixed form: `plots/{spec-id}/implementations/python/{library}.py` and `plots/{spec-id}/metadata/python/{library}.yaml`.
+
 Example: `plots/scatter-basic/` contains everything for the basic scatter plot.
 
 ### Spec ID Naming Convention
@@ -137,19 +141,32 @@ Examples: `scatter-basic`, `scatter-color-mapped`, `bar-grouped-horizontal`, `he
 ### PR Labels (set by workflows)
 
 - **`approved`** - Human approved specification for merge
-- **`ai-approved`** - AI quality check passed (score >= 90, or >= 50 after 3 attempts)
-- **`ai-rejected`** - AI quality check failed (score < 90), triggers repair loop
+- **`ai-approved`** - AI quality check passed at the current cascading threshold (see below)
+- **`ai-rejected`** - AI quality check failed at the current threshold, triggers repair loop
 - **`quality:XX`** - Quality score (e.g., `quality:92`)
 
+**Quality threshold cascade** (`.github/workflows/impl-review.yml`): the threshold drops by 10 each repair attempt to give partial credit for incremental improvement.
+
+| Review # | Repair attempt | Threshold |
+|----------|----------------|-----------|
+| 1 (initial) | 0 | ≥ 90 |
+| 2 | 1 | ≥ 80 |
+| 3 | 2 | ≥ 70 |
+| 4 | 3 | ≥ 60 |
+| 5 | 4 | ≥ 50 |
+
+If the score is still below 50 after 4 repair attempts, the PR is closed (`gh pr close`) and the workflow posts a comment with next-step options. Regeneration is **manual**, not automatic — re-apply the `generate:{library}` label on the spec issue to start a fresh attempt.
+
 **Specification Lifecycle:**
 ```
 [open] spec-request → approved → spec-ready [implementations can start]
 ```
 
 **Implementation PR Lifecycle:**
 ```
-[open] → impl-review → ai-approved (≥90) → impl-merge → impl:{library}:done
-                     → ai-rejected (<90) → impl-repair (×3) → ai-approved (≥50) or failed (<50)
+[open] → impl-review → ai-approved (≥ current threshold) → impl-merge → impl:{library}:done
+                     → ai-rejected (< threshold)        → impl-repair (×4) → cascade re-review
+                     → after 4 failed repairs           → close PR; manual regen via generate:{library} label
 ```
 
 ## Code Standards
@@ -212,7 +229,7 @@ plt.savefig('plot.png', dpi=300, bbox_inches='tight')
 
 ## Tech Stack
 
-- **Backend**: FastAPI, SQLAlchemy (async), PostgreSQL, Python 3.14+
+- **Backend**: FastAPI, SQLAlchemy (async), PostgreSQL, Python 3.13+
 - **Frontend**: React 19, TypeScript 6, Vite 8, MUI 9
 - **Package Manager**: uv (Python), yarn (Node.js)
 - **Linting**: Ruff (Python), ESLint (TypeScript)
@@ -223,8 +240,8 @@ The project runs on **Google Cloud Platform** (europe-west4 region):
 
 | Service | Component          | Purpose |
 |---------|--------------------|---------|
-| **Cloud Run** | `anyplot-backend`  | FastAPI API (auto-scaling, serverless) |
-| **Cloud Run** | `anyplot-frontend` | React SPA served via nginx |
+| **Cloud Run** | `anyplot-api` | FastAPI API (auto-scaling, serverless) |
+| **Cloud Run** | `anyplot-app` | React SPA served via nginx |
 | **Cloud SQL** | PostgreSQL 18      | Database (Unix socket in production) |
 | **Cloud Storage** | `anyplot-images`   | Preview images (GCS bucket) |
 | **Secret Manager** | `DATABASE_URL`     | Secure credential storage |

.github/workflows/ci-lint.yml

@@ -63,7 +63,7 @@ jobs:
 
     - name: Install uv
       if: steps.check.outputs.should_lint == 'true'
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
 
     - name: Install dependencies
       if: steps.check.outputs.should_lint == 'true'

.github/workflows/ci-tests.yml

@@ -84,21 +84,25 @@ jobs:
 
     - name: Install uv
       if: steps.check.outputs.should_test == 'true'
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
 
     - name: Install dependencies
       if: steps.check.outputs.should_test == 'true'
       run: uv sync --extra test
 
+    # Dependabot PRs run from forks and cannot access repository secrets,
+    # so skip GCP auth + Cloud SQL Proxy + Codecov upload. Only unit and
+    # integration tests run for Dependabot (no e2e — those need real Postgres).
+
     - name: Authenticate to GCP
-      if: steps.check.outputs.should_test == 'true'
+      if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]'
       uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093  # v3
       with:
         project_id: anyplot
         workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
 
     - name: Start Cloud SQL Proxy
-      if: steps.check.outputs.should_test == 'true'
+      if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]'
       run: |
         # Download Cloud SQL Proxy
         curl -o cloud-sql-proxy https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.14.3/cloud-sql-proxy.linux.amd64
@@ -114,7 +118,7 @@ jobs:
         echo "DATABASE_URL=postgresql+asyncpg://${{ secrets.DB_USER }}:${{ secrets.DB_PASS }}@localhost:5432/${{ secrets.DB_NAME }}" >> $GITHUB_ENV
 
     - name: Run all tests with coverage
-      if: steps.check.outputs.should_test == 'true'
+      if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]'
       run: |
         uv run pytest tests/unit tests/integration tests/e2e \
           -v --tb=short \
@@ -126,16 +130,21 @@ jobs:
       # - Integration tests: SQLite in-memory for repository layer
       # - E2E tests: Real PostgreSQL with separate 'test' database
 
+    - name: Run unit + integration tests (Dependabot)
+      if: steps.check.outputs.should_test == 'true' && github.actor == 'dependabot[bot]'
+      run: |
+        uv run pytest tests/unit tests/integration -v --tb=short
+
     - name: Upload coverage to GitHub Artifacts
-      if: steps.check.outputs.should_test == 'true' && always()
+      if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]' && always()
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
       with:
         name: coverage-report
         path: coverage.xml
         retention-days: 30
 
     - name: Upload coverage to Codecov
-      if: steps.check.outputs.should_test == 'true'
+      if: steps.check.outputs.should_test == 'true' && github.actor != 'dependabot[bot]'
       uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6
       with:
         token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/daily-regen.yml

@@ -1,31 +1,31 @@
 name: "Scheduled: Regen oldest specs"
-run-name: "Scheduled regen (${{ github.event.inputs.count || '2' }} specs)"
+run-name: "Scheduled regen (${{ github.event.inputs.count || '1' }} specs)"
 
 # Picks the N oldest specs (by most-recent implementation `updated` timestamp)
-# and re-dispatches `bulk-generate.yml` for each. Default N=2 per cron tick.
+# and re-dispatches `bulk-generate.yml` for each. Default N=1 per cron tick.
 #
-# Schedule: every 2h between 00:00 and 12:00 UTC (02:00–14:00 Berlin CEST).
-# The 14:00–22:00 UTC slots (16:00–24:00 Berlin) are intentionally skipped so
-# runs never start during the user's 18:00–24:00 Berlin interactive window.
+# Schedule: every 2h, skipping the 20:00–24:00 Berlin (CEST) evening window.
+# Berlin CEST run hours: 00, 02, 04, 06, 08, 10, 12, 14, 16, 18 → UTC 22, 00,
+# 02, 04, 06, 08, 10, 12, 14, 16. The 20:00 and 22:00 Berlin slots (UTC 18, 20)
+# are intentionally skipped so runs never start during the user's evening.
 #
-# bulk-generate is serialised via its own concurrency group, so the 2 dispatched
-# specs run sequentially. With Sonnet + reduced bulk-generate pace, a spec
-# completes well within the 2h slot, leaving the user window clean.
+# bulk-generate is serialised via its own concurrency group. With Sonnet +
+# reduced bulk-generate pace, a single spec completes well within the 2h slot,
+# leaving the user window clean.
 #
 # Triggers:
-#   - schedule: 7× daily (UTC, every 2h up to 12:00)
+#   - schedule: 10× daily (UTC, every 2h except 18:00 and 20:00 UTC)
 #   - workflow_dispatch: manual, with inputs for count + dry-run
 
 on:
-  # Temporarily paused — re-enable in a few days.
-  # schedule:
-  #   - cron: '0 0,2,4,6,8,10,12 * * *'
+  schedule:
+    - cron: '0 0,2,4,6,8,10,12,14,16,22 * * *'
   workflow_dispatch:
     inputs:
       count:
-        description: "How many of the oldest specs to regen (default 2)"
+        description: "How many of the oldest specs to regen (default 1)"
         required: false
-        default: '2'
+        default: '1'
       min_age_hours:
         description: "Skip specs regen'd within this many hours (default 20)"
         required: false
@@ -63,7 +63,7 @@ jobs:
       - name: Pick oldest spec(s)
         id: pick
         env:
-          COUNT: ${{ inputs.count || '2' }}
+          COUNT: ${{ inputs.count || '1' }}
           MIN_AGE_HOURS: ${{ inputs.min_age_hours || '20' }}
         run: |
           python3 <<'PY'

.github/workflows/impl-generate.yml

@@ -39,13 +39,6 @@ concurrency:
   group: impl-generate-${{ inputs.specification_id || github.event.issue.number }}-${{ inputs.library || github.event.label.name }}
   cancel-in-progress: false
 
-env:
-  # Library dependencies mapping
-  # Per-library deps now come from `pyproject.toml` `lib-{library}` extras —
-  # see [project.optional-dependencies] there. Keeping this list in sync was
-  # painful and silently drifted (this env block lagged the pyproject floors
-  # by a full major version on plotly/altair). Single source of truth wins.
-
 jobs:
   generate:
     # Run on label trigger OR workflow_dispatch
@@ -182,7 +175,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
 
       - name: Install system dependencies
         run: |
@@ -312,7 +305,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@567fe954a4527e81f132d87d1bdbcc94f7737434  # v1
+        uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model sonnet"
@@ -331,7 +324,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 60
-        uses: anthropics/claude-code-action@567fe954a4527e81f132d87d1bdbcc94f7737434  # v1
+        uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model sonnet"

.github/workflows/impl-merge.yml

@@ -178,10 +178,20 @@ jobs:
       - name: Merge PR to main (with retry)
         if: steps.check.outputs.should_run == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # ADMIN_TOKEN: PAT with admin scope from a repo-admin user, used so
+          # that `gh pr merge --admin` can bypass the main-branch ruleset
+          # (required-status-checks). Falls back to GITHUB_TOKEN if not set so
+          # the workflow still runs and fails with a clear ruleset error
+          # instead of an opaque auth error.
+          GH_TOKEN: ${{ secrets.ADMIN_TOKEN || secrets.GITHUB_TOKEN }}
           PR_NUM: ${{ steps.check.outputs.pr_number }}
           REPOSITORY: ${{ github.repository }}
+          HAS_ADMIN_TOKEN: ${{ secrets.ADMIN_TOKEN != '' }}
         run: |
+          if [ "$HAS_ADMIN_TOKEN" != "true" ]; then
+            echo "::warning::ADMIN_TOKEN secret is not set — merge will fail if main ruleset enforces required status checks. Add a fine-grained PAT with Contents:Write + Pull requests:Write + Administration:Read+Write as repo secret ADMIN_TOKEN."
+          fi
+
           MAX_ATTEMPTS=5
 
           for attempt in $(seq 1 $MAX_ATTEMPTS); do
@@ -191,9 +201,19 @@ jobs:
             gh pr update-branch "$PR_NUM" --repo "$REPOSITORY" 2>/dev/null || true
             sleep 2
 
+            # --admin bypasses the branch ruleset's required-status-check
+            # gate. Required because impl-generate.yml pushes via GITHUB_TOKEN,
+            # which by GitHub's anti-recursion design does not trigger
+            # downstream CI workflows (Run Linting / Run Tests / Run Frontend
+            # Tests), so impl PRs never get those checks. The pipeline already
+            # gates merge behind the AI quality review threshold.
+            #
+            # Bypass only works if the token has admin role. GITHUB_TOKEN is
+            # only `write`, so a repo-admin PAT is required (ADMIN_TOKEN).
             if gh pr merge "$PR_NUM" \
               --repo "$REPOSITORY" \
               --squash \
+              --admin \
               --delete-branch; then
               echo "::notice::Merge successful on attempt $attempt"
               exit 0

.github/workflows/impl-repair.yml

@@ -62,7 +62,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
 
       - name: Install dependencies
         env:
@@ -104,7 +104,7 @@ jobs:
         id: claude
         continue-on-error: true
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@567fe954a4527e81f132d87d1bdbcc94f7737434  # v1
+        uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model sonnet"
@@ -123,7 +123,7 @@ jobs:
         if: steps.claude.outcome == 'failure'
         id: claude_retry
         timeout-minutes: 45
-        uses: anthropics/claude-code-action@567fe954a4527e81f132d87d1bdbcc94f7737434  # v1
+        uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           claude_args: "--model sonnet"

.github/workflows/impl-review.yml

@@ -140,7 +140,7 @@ jobs:
         id: review
         continue-on-error: true
         timeout-minutes: 30
-        uses: anthropics/claude-code-action@567fe954a4527e81f132d87d1bdbcc94f7737434  # v1
+        uses: anthropics/claude-code-action@ef50f123a3a9be95b60040d042717517407c7256  # v1
         env:
           LIBRARY: ${{ steps.pr.outputs.library }}
           SPEC_ID: ${{ steps.pr.outputs.specification_id }}
@@ -154,10 +154,10 @@ jobs:
             Read `prompts/workflow-prompts/ai-quality-review.md` and follow those instructions.
 
             Variables for this run:
-            - LIBRARY: $LIBRARY
-            - SPEC_ID: $SPEC_ID
-            - PR_NUMBER: $PR_NUMBER
-            - ATTEMPT: $ATTEMPT
+            - LIBRARY: ${{ steps.pr.outputs.library }}
+            - SPEC_ID: ${{ steps.pr.outputs.specification_id }}
+            - PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+            - ATTEMPT: ${{ steps.attempts.outputs.display }}
 
       - name: Extract quality score
         id: score