-
+Fulling is building dedicated AI workspaces: persistent environments that combine
+skills, files, memory, scripts, and runtime. The current v3 foundation provides
+the identity and Kubernetes credential boundary required for that product model.
-
Package AI workspaces once. Share them with people who just need the AI to work.
+## Current Foundation
-
-
-
-
-
-
+- GitHub-only sign-in through Better Auth
+- PostgreSQL-backed users, provider accounts, and sessions
+- a protected application workspace entry
+- one plaintext kubeconfig per user
+- authenticated kubeconfig validation through Kubernetes `SelfSubjectReview`
+- a user-scoped Kubernetes client boundary
-
+The repository intentionally contains no compatibility layer for the previous
+product model or authentication system.
-## Overview
+Read [docs/architecture.md](./docs/architecture.md) for the target Workspace model.
+The user-level kubeconfig in this foundation is not the final Workspace Runtime
+ownership model.
-Fulling is a product for creating ready-to-use AI workspaces.
+## Requirements
-It is built around a practical problem: many professionals can benefit from AI,
-but they do not want to configure skills, prompts, memory, scripts, integrations,
-or runtime settings. Fulling gives creators a place to assemble those pieces,
-then share the finished workspace with the person who needs it.
-
-> [!NOTE]
-> Fulling v3.0 centers on workspace delivery: the setup work happens once, and
-> the recipient opens a prepared AI workspace instead of learning the AI stack.
-
-## Why Fulling?
-
-Most AI tools start with an empty chat box. That works for people who already
-know how to prompt, configure tools, and judge the outputs. It breaks down when
-the user is a domain expert who simply needs help with real work.
-
-Fulling turns that setup into a deliverable:
-
-- a building designer receives a workspace with drawing review workflows,
- project references, and report templates
-- a consultant receives a workspace with client materials, analysis scripts,
- and reusable delivery formats
-- a team receives a workspace with shared context, approved tools, and repeatable
- operating routines
-
-The recipient uses the workspace. The creator owns the configuration.
-
-## Workspace Model
-
-An AI workspace combines the context, capabilities, and runtime needed for a
-specific person or job.
-
-| Part | Purpose |
-| --- | --- |
-| Mission | The job this AI workspace exists to help with |
-| Knowledge | Files, notes, examples, references, and domain material |
-| Memory | Durable context that can evolve over time |
-| Skills | Named capabilities the AI can use |
-| Scripts | Repeatable actions for work that needs reliability |
-| Runtime | A place where tools, code, and automation can run |
-| Sharing | A way to hand the configured workspace to another user |
-
-## How It Works
-
-```text
-Create
- -> choose who the workspace is for
- -> describe the work it supports
- -> add knowledge and files
- -> configure skills, scripts, memory, and runtime
- -> test the workspace
- -> share it with the recipient
-
-Use
- -> open the prepared workspace
- -> ask for work through task-focused entry points
- -> review outputs, files, and approvals
- -> keep using the same workspace as context grows
-```
-
-## What Fulling Is Not
-
-Fulling is not a prompt marketplace, generic chatbot builder, Kubernetes UI, or
-DevOps control panel. Those pieces can exist behind the scenes, but the product
-is organized around prepared AI workspaces.
-
-## Project Status
-
-Fulling v3.0 is the active product direction. The current repository is being
-realigned around the workspace delivery model described above.
-
-The previous v2.0.0 release is available at
-[Fulling v2.0.0](https://github.com/FullAgent/fulling/releases/tag/v2.0.0).
-
-Active branches:
-
-- `v3.0` for the current product direction
-- `release/2.0` for v2 maintenance
-- `main` is not the target branch for v3 work
-
-## Tech Stack
-
-| Area | Stack |
-| --- | --- |
-| App | Next.js 16 App Router, React 19, TypeScript |
-| UI | Tailwind CSS v4, Shadcn/UI, Radix UI |
-| Data | Prisma, PostgreSQL |
-| Auth | NextAuth v5 |
-| Runtime | Kubernetes, KubeBlocks PostgreSQL, ttyd, FileBrowser |
-| Integrations | GitHub App, sandbox-side commands, AI proxy |
-| Testing | Vitest, ESLint |
+- Node.js 22.12 or later
+- pnpm 10.20.0
+- PostgreSQL
+- a GitHub OAuth App
-## Repository Map
+Configure the GitHub OAuth callback as:
```text
-app/ Next.js routes, dashboard, auth, API endpoints
-components/ Shared UI and layout components
-lib/ Application libraries and service code
-prisma/ Database schema and migrations
-runtime/ Runtime image and sandbox support files
-public/ Static icons and assets
+${BETTER_AUTH_URL}/api/auth/callback/github
```
## Local Development
-### Prerequisites
-
-- Node.js 22.12.0 or later
-- pnpm 10.20.0
-- PostgreSQL database
-- Kubernetes cluster with KubeBlocks installed
-- GitHub App and OAuth credentials for GitHub integration work
-
-### Setup
-
```bash
-git clone https://github.com/FullAgent/fulling.git
-cd fulling
-pnpm install
+corepack pnpm install
cp .env.template .env.local
-npx prisma generate
-npx prisma db push
-pnpm dev
+# Fill in the database, Better Auth, and GitHub values.
+corepack pnpm prisma:migrate
+corepack pnpm dev
```
Open [http://localhost:3000](http://localhost:3000).
-## Useful Commands
+This release uses a new baseline schema. Run it against a new database or an
+explicitly reset database; it does not migrate v2 data.
+
+## Commands
```bash
-pnpm dev # Start the development server
-pnpm build # Generate Prisma client and build for production
-pnpm lint # Run ESLint
-pnpm test # Run Vitest
-pnpm test:watch # Run Vitest in watch mode
-npx prisma generate # Generate Prisma client
-npx prisma db push # Push schema changes to the database
+corepack pnpm dev # Start the development server
+corepack pnpm build # Generate Prisma client and build
+corepack pnpm lint # Run ESLint
+corepack pnpm test # Run Vitest
+corepack pnpm test:e2e # Run Playwright
+corepack pnpm prisma:format # Format the Prisma schema
+corepack pnpm prisma:validate # Validate the Prisma schema
+corepack pnpm prisma:migrate # Deploy the baseline migration
```
-## Documentation
+## Credential Boundary
+
+Kubeconfigs are stored as plaintext in PostgreSQL. Database read access grants
+access to users' Kubernetes credentials. Browser-facing APIs never return saved
+content, and logs must not contain tokens, keys, certificates, or kubeconfig
+content.
+
+Validation rejects executable credential plugins, auth-provider plugins, local
+file credential fields, proxy configuration, non-HTTPS API servers, redirects,
+and anonymous identities. Authenticated users may still configure an HTTPS API
+server on any network address. This authenticated outbound-request/SSRF boundary
+is an explicit deployment decision.
+
+## Deployment Reset
+
+Before replacing a v2 deployment, follow
+[docs/v2-resource-inventory.md](./docs/v2-resource-inventory.md). Resetting the
+Fulling database does not delete Kubernetes resources created by v2.
-- [AGENTS.md](./AGENTS.md) - agent guidance for this repository
-- [docs/architecture.md](./docs/architecture.md) - v3 system architecture
+Use [docs/github-oauth-verification.md](./docs/github-oauth-verification.md) to
+verify a real OAuth application before release.
diff --git a/app/(auth)/auth-error/page.tsx b/app/(auth)/auth-error/page.tsx
deleted file mode 100644
index 08b90b9..0000000
--- a/app/(auth)/auth-error/page.tsx
+++ /dev/null
@@ -1,133 +0,0 @@
-'use client';
-
-import { Suspense } from 'react';
-import { MdArrowBack, MdErrorOutline, MdHome, MdRefresh } from 'react-icons/md';
-import Link from 'next/link';
-import { useSearchParams } from 'next/navigation';
-
-import { Button } from '@/components/ui/button';
-
-function ErrorContent() {
- const searchParams = useSearchParams();
- const error = searchParams.get('error');
-
- const getErrorDetails = () => {
- switch (error) {
- case 'Configuration':
- return {
- title: 'Configuration Error',
- message: 'There was a problem with the authentication configuration.',
- code: 'AUTH_CONFIG_ERROR',
- };
- case 'AccessDenied':
- return {
- title: 'Access Denied',
- message: 'You do not have permission to sign in.',
- code: 'AUTH_ACCESS_DENIED',
- };
- case 'Verification':
- return {
- title: 'Verification Failed',
- message: 'The verification token has expired or has already been used.',
- code: 'AUTH_VERIFICATION_FAILED',
- };
- default:
- return {
- title: 'Authentication Error',
- message: 'An unexpected error occurred during authentication.',
- code: 'AUTH_UNKNOWN_ERROR',
- };
- }
- };
-
- const errorDetails = getErrorDetails();
-
- return (
-
- {hasRepo ? 'Connected to GitHub' : 'GitHub Repository'}
-
-
- {hasRepo
- ? 'Your project is currently active and synced with a remote GitHub repository. You can push your latest changes below.'
- : 'Initialize a new repository to start tracking changes. This will create a private repository in your GitHub account and push the initial code.'}
-
+ Fulling validates this credential against the selected Kubernetes cluster before storing
+ it as plaintext. Saved content is never displayed again.
+
+Fulling is building dedicated AI workspaces: persistent environments that combine
+skills, files, memory, scripts, and runtime. The current v3 foundation provides
+the identity and Kubernetes credential boundary required for that product model.
- 
