FrontEnd landing page v1

.env.example

@@ -1,7 +1,11 @@
-# Local PostgreSQL settings only. These defaults are intentionally non-secret.
+# Local development settings only. These defaults are intentionally non-secret.
 # Copy to .env to override them; never commit a real .env file.
 POSTGRES_DB=medcheck
 POSTGRES_USER=medcheck
 POSTGRES_PASSWORD=medcheck_local_only
 POSTGRES_PORT=127.0.0.1:5432
 
+# Export these values into the shell before running Django commands locally.
+# Replace the development-only key outside local development.
+DJANGO_SECRET_KEY=local-development-only-change-me
+DJANGO_DEBUG=true

.github/workflows/pr-checks.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
+          ref: ${{ github.event.pull_request.head.sha }}
       - uses: gitleaks/gitleaks-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -68,7 +68,7 @@ jobs:
           version: 10.4.1
       - uses: actions/setup-node@v4
         with:
-          node-version: 22.14.0
+          node-version: 22.23.3
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
       - name: Install locked dependencies
@@ -81,10 +81,23 @@ jobs:
         run: pnpm typecheck
       - name: Run infrastructure tests with coverage
         run: pnpm test
+      - name: Build web application
+        run: pnpm build
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Run landing-page browser tests
+        run: pnpm test:e2e
       - name: Upload web coverage
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: web-coverage
           path: web/coverage
           if-no-files-found: ignore
+      - name: Upload Playwright diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: web/playwright-report
+          if-no-files-found: ignore

.node-version

@@ -0,0 +1 @@
+22.23.3

AGENTS.md

@@ -2,10 +2,12 @@
 
 ## Current status
 
-`infrastructure_plan.md` is the source of truth. The web tooling, Vite entrypoint,
-Docker foundation, and minimal Django project scaffold are in place. Do not
-introduce product pages, API handlers, domain models, authentication, or
-business data while performing infrastructure work.
+`infrastructure_plan.md` is the source of truth for architectural decisions. The
+web tooling, MedCheck landing-page prototype, Playwright tests, Docker
+foundation, and minimal Django project scaffold are in place. The landing page
+only echoes a local search term; no medical search, production API, domain
+model, authentication, or persistence workflow exists. Do not expand product
+behavior while performing infrastructure work.
 
 ## Repository map
 
@@ -17,10 +19,11 @@ business data while performing infrastructure work.
 - `backend/` — Django project scaffold, Python dependency/tool configuration, and
   infrastructure-only tests; no API or business application package exists yet.
 - `web/` — React/Vite entrypoint, dependency/tool configuration, and
-  infrastructure-only tests; no product pages or business UI exists yet.
-- `.github/workflows/pr-checks.yml` — web-only pull-request quality checks.
+  the landing-page prototype with infrastructure and Playwright tests.
+- `.github/workflows/pr-checks.yml` — secret, backend, web, build, and browser
+  pull-request quality checks.
 - `.github/workflows/release.yml` — not created; it requires a selected hosting provider.
-- `docs/` — not created yet.
+- `docs/specs/` — application and setup specifications.
 - `.agents/skills/` — project-specific skills and instructions.
 
 ## Required reading and skill selection
@@ -52,7 +55,8 @@ docker build --file docker/backend.Dockerfile --tag medcheck-backend-tooling .
 docker compose config --quiet
 ./scripts/docker-smoke.sh
 (cd backend && uv run ruff format --check . && uv run ruff check . && uv run pyright && uv run pytest --cov=tests)
-(cd web && pnpm format:check && pnpm lint && pnpm typecheck && pnpm test)
+(cd backend && set -a && source ../.env.example && set +a && uv run python manage.py check)
+(cd web && pnpm format:check && pnpm lint && pnpm typecheck && pnpm test && pnpm build && pnpm test:e2e)
 git diff --check
 ```
 

README.md

@@ -2,9 +2,11 @@
 
 ## Status
 
-The repository has minimal Django and React/Vite application scaffolds, a local
-PostgreSQL service, and pull-request checks. No production API, domain models,
-or product UI exists yet.
+The repository has a minimal Django scaffold, a React/Vite landing-page
+prototype, a local PostgreSQL service, and pull-request checks. The landing page
+accepts a local search term but does not query medical information. No
+production API, domain models, authentication, or persistent product workflow
+exists yet.
 
 ## Repository map
 
@@ -16,33 +18,45 @@ or product UI exists yet.
   smoke test.
 - `backend/` — minimal Django project scaffold, Python/Django tooling, locked
   dependencies, and infrastructure probes; no API or business code exists yet.
-- `web/` — React/Vite entrypoint, locked dependencies, infrastructure probes, and
-  the initial application shell; no product page or business UI exists yet.
-- `.github/workflows/pr-checks.yml` — web-only infrastructure quality checks.
+- `web/` — React/Vite landing-page prototype, locked dependencies,
+  infrastructure probes, and Playwright browser tests.
+- `.github/workflows/pr-checks.yml` — secret scanning plus backend and web
+  quality checks, including the web build and Playwright tests.
 - `.github/dependabot.yml` — weekly dependency-update configuration.
 - `infrastructure_plan.md` — the approved infrastructure plan and source of
   truth for future configuration.
 - `.agents/skills/` — local agent skills.
-- `docs/` and production application source directories — not created yet.
+- `docs/specs/` — implementation specifications and scope boundaries.
+- Production API and domain application packages — not created yet.
 
 ## Getting Started
 
 1. Install [Docker Desktop](https://www.docker.com/products/docker-desktop/)
-   or Docker Engine with Compose v2, [Python 3.13](https://www.python.org/downloads/),
-   [uv](https://docs.astral.sh/uv/getting-started/installation/), and Node.js
-   22 LTS with Corepack enabled. The Docker image supplies Python and uv only
-   for Docker work; host tools support editor and local quality-check workflows.
-2. Optionally copy the non-secret local database defaults:
+   or Docker Engine with Compose v2, [uv](https://docs.astral.sh/uv/getting-started/installation/),
+   and Node.js 22.23.3 with Corepack. The version is recorded in
+   `.node-version`. Install [Python 3.13](https://www.python.org/downloads/) or
+   allow uv to install its managed Python 3.13 runtime. The Docker image supplies
+   Python and uv only for Docker work; host tools support editor and local
+   quality-check workflows.
+2. Copy the non-secret local defaults and export them for Django commands:
 
    ```bash
    cp .env.example .env
+   set -a
+   source .env
+   set +a
    ```
 
+   Docker Compose reads `.env` automatically. Django reads environment variables
+   from the shell, so source the file again in each new shell before running
+   Django commands. Never place a production secret in this file.
+
 3. Install the locked tooling dependencies:
 
    ```bash
    (cd backend && uv sync --all-groups --frozen)
    (cd web && corepack enable && pnpm install --frozen-lockfile)
+   (cd web && pnpm exec playwright install chromium)
    ```
 
 4. Build the development-tooling image:
@@ -57,11 +71,12 @@ or product UI exists yet.
    docker compose up --detach postgres
    ```
 
-6. Run the available infrastructure checks and clean up the Docker foundation:
+6. Run the available backend, web, and browser checks, then clean up the Docker
+   foundation:
 
    ```bash
-   (cd backend && uv run ruff format --check . && uv run ruff check . && uv run pyright && uv run pytest --cov=tests)
-   (cd web && pnpm format:check && pnpm lint && pnpm typecheck && pnpm test)
+   (cd backend && uv run python manage.py check && uv run ruff format --check . && uv run ruff check . && uv run pyright && uv run pytest --cov=tests)
+   (cd web && pnpm format:check && pnpm lint && pnpm typecheck && pnpm test && pnpm build && pnpm test:e2e)
    ./scripts/docker-smoke.sh
    docker compose down --volumes
    ```
@@ -70,8 +85,8 @@ The local database is exposed only on `127.0.0.1:5432` by default. Change
 `POSTGRES_PORT` in an untracked `.env` if that port is occupied. Reset local
 database data with `docker compose down --volumes`.
 
-Playwright end-to-end tests are intentionally deferred until the first product
-workflow exists. A production release workflow is also deferred until a hosting
+Playwright currently verifies the landing-page layout and local search-form
+behavior. A production release workflow remains deferred until a hosting
 provider is selected.
 
 ## Troubleshooting
@@ -82,5 +97,11 @@ provider is selected.
   restart the Compose service.
 - **A stale database is causing unexpected results:** run `docker compose down
   --volumes` before starting again.
-- **`uv` or `pnpm` is missing:** install the host prerequisite from the links
-  above, then rerun the locked install command.
+- **Django reports a missing `DJANGO_SECRET_KEY`:** source the untracked `.env`
+  into the current shell as shown above.
+- **Node reports an unsupported engine:** select Node 22.23.3 from
+  `.node-version`; Node 24 is outside the supported project range. Homebrew's
+  `node@22` is keg-only, so add `/opt/homebrew/opt/node@22/bin` to `PATH` when
+  using that installation.
+- **`uv` or `pnpm` is missing:** install uv or run `corepack enable` under Node
+  22, then rerun the locked install command.

docs/specs/setup-alignment.md

@@ -0,0 +1,55 @@
+# Setup Alignment Specification
+
+## Objective
+
+Make the documented developer setup, pull-request checks, and current MedCheck
+landing-page prototype agree with the repository. The prototype accepts a local
+search term and displays a status message; it does not perform a medical search
+or call a backend API.
+
+## Commands
+
+- Backend install: `cd backend && uv sync --all-groups --frozen`
+- Backend checks: `cd backend && uv run ruff format --check . && uv run ruff check . && uv run pyright && uv run pytest --cov=tests`
+- Web install: `cd web && corepack enable && pnpm install --frozen-lockfile`
+- Web checks: `cd web && pnpm format:check && pnpm lint && pnpm typecheck && pnpm test && pnpm build && pnpm test:e2e`
+- Docker smoke test: `./scripts/docker-smoke.sh`
+
+## Project Structure
+
+- `backend/` contains the minimal Django scaffold and backend tooling.
+- `web/` contains the React/Vite landing-page prototype and its tests.
+- `web/tests/e2e/` contains Playwright browser tests.
+- `.github/workflows/` contains pull-request automation.
+- `docs/specs/` contains implementation specifications.
+
+## Code Style
+
+Use the configured Ruff, Prettier, ESLint, and TypeScript rules. Keep UI state
+local until a backend contract is specified.
+
+## Testing Strategy
+
+Run fast backend and web harness tests first, then build the web application and
+run the landing-page workflow in Chromium with Playwright. CI must enforce the
+same checks and retain Playwright diagnostics when browser tests fail.
+
+## Boundaries
+
+- Always use locked dependencies and safe local-only environment values.
+- Ask before adding APIs, persistence, authentication, or real medical search.
+- Never commit `.env`, real secrets, medical data, or generated build output.
+
+## Success Criteria
+
+- Node 22 and pnpm setup is reproducible and documented.
+- Django's required local environment value is documented and checkable.
+- README and AGENTS accurately describe the current files and commands.
+- Pull requests run formatting, linting, type checks, tests, the web build, and
+  Playwright browser checks.
+- Backend, web, browser, Docker, and repository hygiene checks pass locally.
+
+## Open Questions
+
+The real search behavior, medical-data sources, API contract, authentication,
+and hosting provider remain intentionally unspecified.

web/.prettierignore

@@ -2,3 +2,5 @@
 coverage/
 dist/
 node_modules/
+playwright-report/
+test-results/

web/playwright.config.ts

@@ -1,4 +1,13 @@
 import { defineConfig } from "@playwright/test";
 
-// No web server is defined until the application entrypoint exists.
-export default defineConfig({ testDir: "tests/e2e" });
+export default defineConfig({
+  testDir: "tests/e2e",
+  use: {
+    baseURL: "http://127.0.0.1:5173",
+  },
+  webServer: {
+    command: "./node_modules/.bin/vite --host 127.0.0.1",
+    url: "http://127.0.0.1:5173",
+    reuseExistingServer: true,
+  },
+});