chore: bootstrap tested development tooling and CI Check

.github/workflows/ci_check.yml

@@ -0,0 +1,121 @@
+name: CI Check
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
+  push:
+    branches: [develop, master]
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    name: Python tooling
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: "0.11.29"
+          enable-cache: false
+      - run: uv sync --frozen
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy tooling
+      - name: Test all Python tooling with coverage
+        run: uv run pytest tests/python --cov=domus_tooling --cov-branch --cov-report=term-missing --cov-report=json:coverage-python.json --cov-report=xml:coverage-python.xml
+      - name: Retain tooling coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-tooling-coverage-${{ github.sha }}
+          path: |
+            coverage-python.json
+            coverage-python.xml
+          if-no-files-found: error
+          retention-days: 7
+
+  node:
+    name: Node architecture policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .node-version
+          package-manager-cache: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+          cache: false
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check
+      - run: pnpm test
+      - name: Retain policy coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: node-policy-coverage-${{ github.sha }}
+          path: coverage/
+          if-no-files-found: error
+          retention-days: 7
+
+  architecture:
+    name: Python architecture contracts
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: "0.11.29"
+          enable-cache: false
+      - run: uv sync --frozen
+      - run: uv run lint-imports --config architecture/python-tooling.ini --no-cache
+      - run: uv run pytest tests/architecture
+
+  documentation:
+    name: Local documentation links
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: "0.11.29"
+          enable-cache: false
+      - run: uv sync --frozen --no-dev
+      - run: uv run --no-dev domus-check docs
+
+  aggregate:
+    name: CI Check
+    if: ${{ always() }}
+    needs: [python, node, architecture, documentation]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      DOMUS_CI_RESULTS: ${{ toJSON(needs) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          version: "0.11.29"
+          enable-cache: false
+      - run: uv sync --frozen --no-dev
+      - name: Require every applicable suite to succeed
+        run: uv run --no-dev domus-check aggregate

.gitignore

@@ -0,0 +1,14 @@
+.venv/
+node_modules/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.import_linter_cache/
+.coverage
+coverage/
+coverage-*.json
+coverage-*.xml
+dist/
+htmlcov/

.node-version

@@ -0,0 +1 @@
+24.20.0

.python-version

@@ -0,0 +1 @@
+3.14.6

README.md

@@ -8,7 +8,7 @@ into one responsive interface. Normal operation does not require AI or cloud ser
 
 ## Project status
 
-Domus is in the specification phase. No application is implemented or published yet.
+Domus has started its development-tooling foundation. No household application is implemented or published yet.
 The [documentation foundation issue](https://github.com/vypdev/domus/issues/2)
 tracks eleven Draft SDDs, 82 normative requirements and 353 planned acceptance cases.
 These cases are verification plans, not executed application tests.
@@ -37,6 +37,7 @@ in the application, with the chosen policy and actual awards preserved in the le
 - [Development milestones](docs/roadmap.md)
 - [Acceptance, coverage and CI Check plan](docs/acceptance-plan.md)
 - [Specification validation evidence and limitations](docs/sdd-validation.md)
+- [Development setup, tests and CI Check](docs/development.md)
 
 ## Quality and contribution
 
@@ -60,11 +61,12 @@ preparation when necessary. Merge, release and deployment remain separately auth
 
 All SDDs remain Draft while material decisions are reviewed. Their original Copilot
 format and consistency checks pass. The proposed SDK catalog still fails the unchanged
-upstream evidence validator because application entrypoints, source and tests do not
-exist yet; no fake paths or gate-readiness claims are used. See the
+upstream evidence validator for the ten capabilities without implementation. Delivery-quality
+registers only its real partial tooling/CI evidence; no fake paths or gate-readiness claims are used. See the
 [adoption note](docs/copilot-adoption.md).
 
 The supplied brief ends at the beginning of section 10.2. The owner completed the
 barcode scope on 2026-10-29: camera/manual entry, local matching and optional Internet
 product lookup. Provider feasibility and device evidence still require review.
-No application build/test commands or CI workflow are installed by this documentation-only change.
+The initial tooling/tests and a separate CI Check workflow are now implemented; see the development guide.
+Household application, UI and HA runtime tests remain future implementation work.

architecture/frontend.mjs

@@ -0,0 +1,25 @@
+/** @type {import('dependency-cruiser').IConfiguration} */
+const configuration = {
+  forbidden: [
+    {name: "no-cycles", severity: "error", from: {}, to: {circular: true}},
+    {name: "no-unresolved", severity: "error", from: {}, to: {couldNotResolve: true}},
+    {
+      name: "inner-layers-stay-pure", severity: "error",
+      from: {path: "^frontend/src/(domain|application)/"},
+      to: {path: "^frontend/src/(adapters|infrastructure|presentation|composition)/"},
+    },
+    {
+      name: "inner-layers-no-frameworks", severity: "error",
+      from: {path: "^frontend/src/(domain|application)/"},
+      to: {path: "(^|/)(node_modules/)?(lit|@lit/[^/]+|vite|home-assistant-js-websocket)(/|$)"},
+    },
+    {
+      name: "presentation-no-concrete-adapters", severity: "error",
+      from: {path: "^frontend/src/presentation/"},
+      to: {path: "^frontend/src/(adapters|infrastructure|composition)/"},
+    },
+  ],
+  options: {doNotFollow: {path: "node_modules"}, tsPreCompilationDeps: true},
+};
+
+export default configuration;

architecture/python-application.ini

@@ -0,0 +1,33 @@
+[importlinter]
+root_package = domus
+include_external_packages = True
+
+[importlinter:contract:layers]
+name = Application dependencies point inward
+type = layers
+layers =
+    domus.composition
+    domus.entrypoints | domus.infrastructure
+    domus.application
+    domus.domain
+
+[importlinter:contract:pure-inner-layers]
+name = Domain and application exclude concrete frameworks and I/O
+type = forbidden
+source_modules =
+    domus.domain
+    domus.application
+forbidden_modules =
+    fastapi
+    homeassistant
+    httpx
+    requests
+    sqlite3
+    sqlalchemy
+    subprocess
+
+[importlinter:contract:no-cycles]
+name = Application modules remain acyclic
+type = acyclic_siblings
+ancestors = domus
+depth = 100

architecture/python-tooling.ini

@@ -0,0 +1,24 @@
+[importlinter]
+root_package = domus_tooling
+include_external_packages = True
+
+[importlinter:contract:pure-policy]
+name = CI policy cannot depend on command or filesystem adapters
+type = forbidden
+source_modules = domus_tooling.ci_policy
+forbidden_modules =
+    domus_tooling.cli
+    domus_tooling.docs
+    os
+    pathlib
+    subprocess
+    json
+    sqlite3
+    fastapi
+    httpx
+
+[importlinter:contract:no-cycles]
+name = Tooling modules remain acyclic
+type = acyclic_siblings
+ancestors = domus_tooling
+depth = 100

docs/acceptance-plan.md

@@ -4,6 +4,11 @@ The SDD inventory contains 353 distinct planned cases across eleven capabilities
 The counts are derived from concrete observable scenarios and are minimums; no application tests have run.
 Formatting, catalog metadata, branch readiness and working product acceptance are separate gates.
 
+The first implementation is development tooling, with 85 executed tests recorded separately in the
+[development guide](development.md). Its coverage measures the actual Python tooling and declarative
+Node architecture policy, not the unimplemented backend/UI/HA product. The original product case floor
+remains planned; passing tooling tests does not satisfy all product acceptance cases.
+
 ## From the first source file
 
 Write meaningful behavior tests with each implementation. Enforce 100% supported first-party line, statement,

docs/copilot-adoption.md

@@ -43,6 +43,6 @@ Only then may a contributor check out that ref and incorporate this prepared pac
 is created, renamed, force-pushed or deleted by this contributor.
 A linked PR carries validation and unresolved decisions; maintainers own merge and deployment.
 
-No runtime package, pnpm task or CI workflow exists in Domus yet. Commands appearing in the unchanged
-upstream standard are upstream commands, not installed Domus capabilities. The draft-check runner shipped
-outside this repository is a review aid and does not replace the Action's bundled authority.
+The specification foundation had no runtime package, pnpm task or project CI. Issue #4 now adds a development-tooling package, locked dependencies, tests and a separate project-owned CI Check workflow, documented in [development](development.md). Household application/runtime capabilities remain prospective. Commands in the unchanged upstream standard are not Domus commands unless the development guide verifies them. The original draft-check runner outside this repository remains a review aid and does not replace the Action's bundled authority.
+
+The current catalog registers only real delivery-quality tooling/CI evidence. Its proposed/Draft status remains unchanged, and the other ten capabilities retain absent implementation evidence. The pinned original validator therefore reports 30 remaining missing-evidence errors; the foundation's original 33-error result is preserved separately. This is ordinary evidence registration after implementation, not a schema/status bypass or a Copilot change.

docs/decisions.md

@@ -15,8 +15,8 @@ Confirmed owner requirements are recorded in [product vision](product-vision.md)
 | A9 | Human HA context mapped to roles; automation uses narrow technical grants | Context does not establish per-MCP-client identity automatically | Service authorization review |
 | A10 | Accepted: one Domus declarative motor with simple/default and optional advanced editors, both at first release; HA can also call public Domus actions | One versioned model preserves behavior between editors; engine policy stays separate from native HA transport | Owner confirmed 2026-10-29; DSL bounds, recovery and loop/permission evidence remain required |
 | A11 | Isolated domus/domus_edge namespaces and credentials in both targets | Stable and Edge can coexist safely | Packaging and HA registry review |
-| A12 | 100% supported first-party coverage metrics, with behavior-driven cases | Owner requires maximum coverage from the first code; no blanket exclusions | Quality toolchain review |
-| A13 | Draft catalog retains empty implementation evidence until it exists | Audited SDK validator rejects empty code/entrypoints/tests even for proposed capabilities | Gate readiness blocked; do not change Copilot |
+| A12 | 100% supported first-party coverage metrics, with behavior-driven cases | Owner requires maximum coverage from the first code; no blanket exclusions | Initial tooling metrics enforced; separate application/HA coverage and channel proof remain required |
+| A13 | Draft catalog retains empty implementation evidence until it exists | Audited SDK validator rejects empty code/entrypoints/tests even for proposed capabilities | Tooling-only delivery-quality evidence now exists; other proposed capabilities remain without implementation evidence. Gate readiness is still blocked; do not change Copilot |
 | A14 | Accepted: camera scan, manual entry, local catalog and optional Internet product lookup | Local operation remains useful without an external provider; candidates retain provenance and require schema validation | Owner completed barcode scope 2026-10-29; provider feasibility/terms, library and device evidence remain required |
 | A15 | Accepted defaults: adults complete without verification; restricted performers need adult approval | Resolve effective verification from the actual performers and authorized policy, not just the submitter's role | Owner confirmed 2026-10-29; explicit task overrides and permission contracts require tests |
 | A16 | Accepted: adjustable actual material quantities in the completion form and the same submission, configurable per task | Keep one household action while Inventory owns explicit, attributable consumption and per-line receipts | Owner confirmed 2026-10-29; combined-command permission/recovery contracts require tests |