Codex setting project scaffolding

.github/workflows/pr-checks.yml

@@ -12,10 +12,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
       - uses: gitleaks/gitleaks-action@v2
-        //changed here because github told me...
         env:
-        GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
 
   backend:
     name: Backend tooling
@@ -60,13 +63,12 @@ jobs:
         working-directory: web
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
         with:
-          node-version: 22.14.0
-      - name: Enable Corepack
-        run: corepack enable
+          version: 10.4.1
       - uses: actions/setup-node@v4
         with:
+          node-version: 22.14.0
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
       - name: Install locked dependencies

AGENTS.md

@@ -2,10 +2,10 @@
 
 ## Current status
 
-`infrastructure_plan.md` is the source of truth. The web-only tooling and Docker
-foundation are in place, but production application code has not been created. Do not introduce
-pages, routes, API handlers, domain models, authentication, or business data
-while performing infrastructure work.
+`infrastructure_plan.md` is the source of truth. The web tooling, Vite entrypoint,
+Docker foundation, and minimal Django project scaffold are in place. Do not
+introduce product pages, API handlers, domain models, authentication, or
+business data while performing infrastructure work.
 
 ## Repository map
 
@@ -14,10 +14,10 @@ while performing infrastructure work.
 - `docker/backend.Dockerfile`, `docker-compose.yml`, and `.dockerignore` —
   Docker tooling and local PostgreSQL only.
 - `scripts/docker-smoke.sh` — infrastructure-owned smoke test.
-- `backend/` — Python dependency/tool configuration and infrastructure-only tests;
-  no Django application package exists yet.
-- `web/` — React/Vite dependency/tool configuration and infrastructure-only tests;
-  no React application entrypoint exists yet.
+- `backend/` — Django project scaffold, Python dependency/tool configuration, and
+  infrastructure-only tests; no API or business application package exists yet.
+- `web/` — React/Vite entrypoint, dependency/tool configuration, and
+  infrastructure-only tests; no product pages or business UI exists yet.
 - `.github/workflows/pr-checks.yml` — web-only pull-request quality checks.
 - `.github/workflows/release.yml` — not created; it requires a selected hosting provider.
 - `docs/` — not created yet.

README.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-The repository has a web-only development foundation: pinned backend and web
-tooling, a local PostgreSQL service, and pull-request checks. No production
-Django or React application code exists yet.
+The repository has minimal Django and React/Vite application scaffolds, a local
+PostgreSQL service, and pull-request checks. No production API, domain models,
+or product UI exists yet.
 
 ## Repository map
 
@@ -14,10 +14,10 @@ Django or React application code exists yet.
   readiness health check.
 - `scripts/docker-smoke.sh` — disposable PostgreSQL readiness and `SELECT 1`
   smoke test.
-- `backend/` — Python/Django tooling, locked dependencies, and infrastructure
-  probes; no Django project or API code exists yet.
-- `web/` — React/Vite tooling, locked dependencies, and infrastructure probes;
-  no page, component, or Vite entrypoint exists yet.
+- `backend/` — minimal Django project scaffold, Python/Django tooling, locked
+  dependencies, and infrastructure probes; no API or business code exists yet.
+- `web/` — React/Vite entrypoint, locked dependencies, infrastructure probes, and
+  the initial application shell; no product page or business UI exists yet.
 - `.github/workflows/pr-checks.yml` — web-only infrastructure quality checks.
 - `.github/dependabot.yml` — weekly dependency-update configuration.
 - `infrastructure_plan.md` — the approved infrastructure plan and source of
@@ -70,9 +70,9 @@ The local database is exposed only on `127.0.0.1:5432` by default. Change
 `POSTGRES_PORT` in an untracked `.env` if that port is occupied. Reset local
 database data with `docker compose down --volumes`.
 
-Vite builds and Playwright end-to-end tests are intentionally unavailable until
-the future React application supplies an entrypoint and workflows. A production
-release workflow is also deferred until a hosting provider is selected.
+Playwright end-to-end tests are intentionally deferred until the first product
+workflow exists. A production release workflow is also deferred until a hosting
+provider is selected.
 
 ## Troubleshooting
 

backend/config/asgi.py

@@ -0,0 +1,16 @@
+"""
+ASGI config for config project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/5.2/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+
+application = get_asgi_application()

backend/config/settings.py

@@ -0,0 +1,123 @@
+"""
+Django settings for config project.
+
+Generated by 'django-admin startproject' using Django 5.2.17.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/5.2/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/5.2/ref/settings/
+"""
+
+import os
+from pathlib import Path
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/5.2/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = os.environ.get("DJANGO_DEBUG", "").lower() == "true"
+
+ALLOWED_HOSTS = []
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+ROOT_URLCONF = "config.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "config.wsgi.application"
+
+
+# Database
+# https://docs.djangoproject.com/en/5.2/ref/settings/#databases
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR / "db.sqlite3",
+    }
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/5.2/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/5.2/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/5.2/howto/static-files/
+
+STATIC_URL = "static/"
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/5.2/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

backend/config/urls.py

@@ -0,0 +1,23 @@
+"""
+URL configuration for config project.
+
+The `urlpatterns` list routes URLs to views. For more information please see:
+    https://docs.djangoproject.com/en/5.2/topics/http/urls/
+Examples:
+Function views
+    1. Add an import:  from my_app import views
+    2. Add a URL to urlpatterns:  path('', views.home, name='home')
+Class-based views
+    1. Add an import:  from other_app.views import Home
+    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
+Including another URLconf
+    1. Import the include() function: from django.urls import include, path
+    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
+"""
+
+from django.contrib import admin
+from django.urls import path
+
+urlpatterns = [
+    path("admin/", admin.site.urls),
+]

backend/config/wsgi.py

@@ -0,0 +1,16 @@
+"""
+WSGI config for config project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/5.2/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+
+application = get_wsgi_application()

backend/manage.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+"""Django's command-line utility for administrative tasks."""
+
+import os
+import sys
+
+
+def main():
+    """Run administrative tasks."""
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.settings")
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == "__main__":
+    main()

web/.prettierignore

@@ -1,3 +1,4 @@
 .pnpm-store/
 coverage/
+dist/
 node_modules/

web/eslint.config.mjs

@@ -2,7 +2,7 @@ import eslint from "@eslint/js";
 
 export default [
   {
-    ignores: [".pnpm-store/**", "coverage/**", "node_modules/**"],
+    ignores: [".pnpm-store/**", "coverage/**", "dist/**", "node_modules/**"],
   },
   eslint.configs.recommended,
   {

web/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#f7f5f0" />
+    <title>Medcheck</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

web/package.json

@@ -3,18 +3,20 @@
   "version": "0.0.0",
   "private": true,
   "packageManager": "pnpm@10.4.1",
-  "description": "Infrastructure-only web tooling for Medcheck.",
+  "description": "React web client for Medcheck.",
   "engines": {
     "node": ">=22 <23",
     "pnpm": ">=10 <11"
   },
   "scripts": {
+    "dev": "vite",
     "format:check": "prettier --check .",
     "lint": "eslint . --max-warnings=0",
     "typecheck": "tsc --noEmit --project tsconfig.json",
     "test": "jest --coverage",
     "test:e2e": "playwright test",
-    "build": "echo 'A Vite build is unavailable until the web application entrypoint is implemented.' >&2; exit 1"
+    "build": "vite build",
+    "preview": "vite preview"
   },
   "dependencies": {
     "react": "^19.0.0",

web/src/App.tsx

@@ -0,0 +1,34 @@
+export function App() {
+  return (
+    <main className="shell">
+      <header className="masthead">
+        <p className="eyebrow">Personal health workspace</p>
+        <span
+          className="status"
+          aria-label="Application status: scaffold ready"
+        >
+          <span aria-hidden="true" /> Scaffold ready
+        </span>
+      </header>
+
+      <section className="intro" aria-labelledby="page-title">
+        <p className="kicker">Medcheck</p>
+        <h1 id="page-title">A clear starting point for your health records.</h1>
+        <p className="summary">
+          The React and Vite foundation is ready. Your first workflow will have
+          a focused home here once the product details are defined.
+        </p>
+      </section>
+
+      <section className="next-step" aria-labelledby="next-step-title">
+        <p className="card-label">Next step</p>
+        <h2 id="next-step-title">Define the first user workflow</h2>
+        <p>
+          This shell is intentionally small: it proves the browser entrypoint,
+          styling pipeline, and accessible React mount without inventing
+          application behavior.
+        </p>
+      </section>
+    </main>
+  );
+}