chore: remove migrations (api-gw owns DB, Temporal owns execution state)

- action/ → activity/ (Temporal activities)
- statemachine/ → workflow/ (Temporal workflows)
- Removed internal/api/ and cmd/server/ (api-gw handles HTTP, Temporal is the API)
- Created pkg/types/types.go as single source of truth for all shared types
- Extracted CallRoleLLM helper (DRY: implementer/planner/judge shared pattern)
- Fixed circular import: workflow_graph_query uses string activity names
- Fixed logger.logf → logger.Info/Warn (method didn't exist)
- Fixed routing types: added Branches, Activity, BackoffSeconds, TaskActivity
- Fixed db.Canvas.Name, db.Client→DB, GetWorkflow→FetchWorkflow
- Removed unused imports
- All tests pass, build clean, vet clean

.env.example

@@ -0,0 +1,22 @@
+# Workflows Backend Configuration
+
+# Database (memory-db CNPG in K8s)
+# Option A: Direct DATABASE_URL
+DATABASE_URL=postgresql://app:[email protected]:5432/memory?sslmode=disable
+
+# Option B: Individual env vars (used if DATABASE_URL is empty)
+DATABASE_HOST=memory-db-rw.poimen.svc.cluster.local
+DATABASE_PORT=5432
+DATABASE_NAME=memory
+DATABASE_USER=app
+DATABASE_PASSWORD=PASSWORD
+
+# Temporal
+TEMPORAL_HOST_PORT=localhost:7233
+TEMPORAL_NAMESPACE=default
+
+# API Server
+API_PORT=8080
+
+# Logging
+VERBOSE=false

.gitea/workflows/build-push.yml

@@ -0,0 +1,46 @@
+name: Build & Push Workflows Image
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-push:
+    runs-on: golang
+    env:
+      REGISTRY: forgejo.riotpiao.com
+      IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+      - name: Build image
+        run: |
+          docker build --no-cache \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"

.gitea/workflows/ci.yaml

@@ -1,66 +1,43 @@
-name: CI
+name: ci
 
 on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-env:
-  GOPRIVATE: forgejo.riotpiao.com
-  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
-  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
-  ci:
-    name: CI
+  test:
     runs-on: golang
+    container:
+      image: golang:1.26
+    env:
+      GOPRIVATE: forgejo.riotpiao.com
+      GITHUB_TOKEN: ${{ secrets.REGISTRY_PAT }}
     steps:
-      - name: Install Node.js and Docker
+      - name: Configure git authentication
         run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
+          git config --global url."https://oauth2:${{ secrets.REGISTRY_PAT }}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+          git config --global credential.helper store
+          echo "https://oauth2:${{ secrets.REGISTRY_PAT }}@forgejo.riotpiao.com" >> ~/.git-credentials
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        run: |
+          git init
+          git remote add origin https://forgejo.riotpiao.com/rock/poimen-workflows.git
+          git fetch origin ${{ github.ref_name }} --depth=1
+          git checkout FETCH_HEAD
 
       - name: Download dependencies
         run: go mod download
 
-      - name: Go vet
+      - name: Tidy modules
+        run: go mod tidy
+
+      - name: Test
+        run: go test -v ./...
+
+      - name: Build
+        run: go build -o /tmp/poimen-bin/ ./cmd/...
+
+      - name: Vet
         run: go vet ./...
-
-      - name: Go test
-        run: go test ./...
-
-      - name: Build binary
-        run: CGO_ENABLED=0 GOOS=linux go build -o /tmp/poimen-worker ./cmd/worker
-
-      - name: Get short SHA
-        id: sha
-        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
-        env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build Docker image
-        run: |
-          docker build --no-cache \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" .
-
-      - name: Push Docker image
-        run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-
-      - name: Prune unused images
-        run: docker image prune -a --force 2>&1 | tail -3 || true

.sops.yaml

@@ -1,3 +0,0 @@
-creation_rules:
-  - path_regex: k8s/.*\.enc\.ya?ml
-    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla

Dockerfile

@@ -1,20 +1,22 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.21-alpine as builder
 
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -o workflows ./cmd/poimen/main.go
 
-# Re-use CI-built binary if present, otherwise build
-ARG BINARY_PATH=
-RUN if [ -n "$BINARY_PATH" ] && [ -f "$BINARY_PATH" ]; then \
-      cp "$BINARY_PATH" worker; \
-    else \
-      CGO_ENABLED=0 GOOS=linux go build -o worker ./cmd/worker; \
-    fi
+FROM alpine:latest
 
-FROM alpine:3.20
 RUN apk --no-cache add ca-certificates
+
 WORKDIR /app
-COPY --from=builder /app/worker .
-ENTRYPOINT ["./worker"]
+COPY --from=builder /app/workflows .
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["./workflows"]

activity/memory.go

@@ -92,9 +92,9 @@ func RetrieveMemoryActivity(ctx context.Context, in RetrieveMemoryInput) (Retrie
 	}
 
 	// Get memory service URL and token
-	baseURL := os.Getenv("MEMORY_SERVICE_URL")
+	baseURL := os.Getenv("POIMEN_MEMORY_URL")
 	if baseURL == "" {
-		baseURL = "http://localhost:8080"
+		baseURL = "http://poimen-memory.poimen.svc.cluster.local:8080"
 	}
 
 	token := os.Getenv("POIMEN_MEMORY_TOKEN")

activity/memory_test.go

@@ -39,7 +39,7 @@ func TestRetrieveMemoryActivity_Query(t *testing.T) {
 	defer server.Close()
 
 	// Set env for test
-	t.Setenv("MEMORY_SERVICE_URL", server.URL)
+	t.Setenv("POIMEN_MEMORY_URL", server.URL)
 
 	output, err := RetrieveMemoryActivity(context.Background(), RetrieveMemoryInput{
 		Query:   "security scanning",
@@ -93,7 +93,7 @@ func TestRetrieveMemoryActivity_Context(t *testing.T) {
 	}))
 	defer server.Close()
 
-	t.Setenv("MEMORY_SERVICE_URL", server.URL)
+	t.Setenv("POIMEN_MEMORY_URL", server.URL)
 
 	output, err := RetrieveMemoryActivity(context.Background(), RetrieveMemoryInput{
 		Query: "security scan repo",

activity/synthesis.go

@@ -1,346 +0,0 @@
-package activity
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"log/slog"
-	"regexp"
-	"strings"
-
-	"github.com/rockliang/poimen/workflows/internal/memory"
-	"github.com/rockliang/poimen/workflows/pkg/types"
-)
-
-// SynthesisActivities holds dependencies for synthesis pipeline activities.
-type SynthesisActivities struct {
-	memClient *memory.Client
-}
-
-// NewSynthesisActivities creates synthesis activities with a memory service client.
-func NewSynthesisActivities(memClient *memory.Client) *SynthesisActivities {
-	return &SynthesisActivities{memClient: memClient}
-}
-
-// Re-export shared types from pkg/types
-type SynthesisInput = types.SynthesisInput
-type ExtractedEntity = types.ExtractedEntity
-type ExtractedFact = types.ExtractedFact
-type ContradictionResult = types.ContradictionResult
-type PersistInput = types.PersistInput
-
-// ChunkAndEmbedActivity chunks text and generates a chunk ID.
-// Stage 1: Creates a deterministic chunk ID from content hash,
-// then ingests via memory service for embedding generation.
-func (s *SynthesisActivities) ChunkAndEmbedActivity(ctx context.Context, input SynthesisInput) (string, error) {
-	logger := slog.Default()
-
-	// Generate deterministic chunk ID from content
-	hash := sha256.Sum256([]byte(input.Text))
-	chunkID := "chunk-" + hex.EncodeToString(hash[:8])
-
-	logger.Info("chunking text", "chunk_id", chunkID, "text_len", len(input.Text))
-
-	// Ingest via memory service (generates embedding)
-	_, err := s.memClient.Ingest(ctx, &memory.IngestRequest{
-		Project: input.Project,
-		Source:  input.Source,
-		Kind:    input.Kind,
-		Text:    input.Text,
-		Metadata: map[string]interface{}{
-			"chunk_id": chunkID,
-			"tags":     input.Tags,
-		},
-	})
-	if err != nil {
-		return "", fmt.Errorf("ingest chunk: %w", err)
-	}
-
-	return chunkID, nil
-}
-
-// ExtractEntitiesActivity extracts entities from text using pattern matching
-// and wiki-link detection. LLM extraction is a future enhancement.
-// Stage 2: Returns entities with confidence scores.
-func (s *SynthesisActivities) ExtractEntitiesActivity(ctx context.Context, chunkID string, text string) ([]ExtractedEntity, error) {
-	logger := slog.Default()
-	logger.Info("extracting entities", "chunk_id", chunkID)
-
-	entities := make([]ExtractedEntity, 0)
-	seen := make(map[string]bool)
-
-	// Pattern 1: Wiki-link extraction [[EntityName]]
-	wikiPattern := regexp.MustCompile(`\[\[([^\]]+)\]\]`)
-	for _, match := range wikiPattern.FindAllStringSubmatch(text, -1) {
-		name := strings.TrimSpace(match[1])
-		if !seen[name] {
-			entities = append(entities, ExtractedEntity{
-				Name:       name,
-				EntityType: "reference",
-				Confidence: 0.95,
-			})
-			seen[name] = true
-		}
-	}
-
-	// Pattern 2: Capitalized proper nouns (simple NER)
-	properNounPattern := regexp.MustCompile(`\b([A-Z][a-z]+(?:\s+[A-Z][a-z]+)*)\b`)
-	for _, match := range properNounPattern.FindAllStringSubmatch(text, -1) {
-		name := match[1]
-		if !seen[name] && !isCommonWord(name) && len(name) > 2 {
-			entities = append(entities, ExtractedEntity{
-				Name:       name,
-				EntityType: classifyEntity(name),
-				Confidence: 0.70,
-			})
-			seen[name] = true
-		}
-	}
-
-	// Pattern 3: Technical terms (ALL_CAPS or camelCase)
-	techPattern := regexp.MustCompile(`\b([A-Z][A-Z_]{2,}|[a-z]+[A-Z][a-zA-Z]+)\b`)
-	for _, match := range techPattern.FindAllStringSubmatch(text, -1) {
-		name := match[1]
-		if !seen[name] {
-			entities = append(entities, ExtractedEntity{
-				Name:       name,
-				EntityType: "technical",
-				Confidence: 0.65,
-			})
-			seen[name] = true
-		}
-	}
-
-	logger.Info("entities extracted", "count", len(entities))
-	return entities, nil
-}
-
-// ExtractFactsActivity extracts subject-predicate-object facts from text.
-// Stage 3: Pattern-based extraction with entity context.
-func (s *SynthesisActivities) ExtractFactsActivity(ctx context.Context, chunkID string, text string, entities []ExtractedEntity) ([]ExtractedFact, error) {
-	logger := slog.Default()
-	logger.Info("extracting facts", "chunk_id", chunkID, "entity_count", len(entities))
-
-	facts := make([]ExtractedFact, 0)
-
-	// Build entity name set for matching
-	entityNames := make(map[string]bool)
-	for _, e := range entities {
-		entityNames[strings.ToLower(e.Name)] = true
-	}
-
-	// Pattern: "X uses/runs/has Y"
-	verbPatterns := []struct {
-		pattern   *regexp.Regexp
-		predicate string
-	}{
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+uses?\s+(.+?)(?:\.|,|$)`), "uses"},
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+runs?\s+(?:on\s+)?(.+?)(?:\.|,|$)`), "runs_on"},
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+(?:has|have)\s+(.+?)(?:\.|,|$)`), "has"},
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+(?:is|are)\s+(.+?)(?:\.|,|$)`), "is"},
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+(?:depends?\s+on|requires?)\s+(.+?)(?:\.|,|$)`), "depends_on"},
-		{regexp.MustCompile(`(?i)(\w+(?:\s+\w+)?)\s+(?:connects?\s+to|talks?\s+to)\s+(.+?)(?:\.|,|$)`), "connects_to"},
-	}
-
-	for _, vp := range verbPatterns {
-		for _, match := range vp.pattern.FindAllStringSubmatch(text, -1) {
-			subject := strings.TrimSpace(match[1])
-			object := strings.TrimSpace(match[2])
-
-			// Validation: skip empty or invalid extracts
-			if len(subject) == 0 || len(object) == 0 {
-				continue // Skip empty subject/object
-			}
-
-			// Truncate overly long objects (avoid capturing entire sentence)
-			if len(object) > 500 {
-				logger.Info("truncating long object", "original_len", len(object), "subject", subject, "predicate", vp.predicate)
-				object = object[:500]
-			}
-
-			// Truncate overly long subjects
-			if len(subject) > 200 {
-				logger.Info("truncating long subject", "original_len", len(subject), "predicate", vp.predicate)
-				subject = subject[:200]
-			}
-
-			// Boost confidence if subject/object are known entities
-			confidence := 0.60
-			if entityNames[strings.ToLower(subject)] {
-				confidence += 0.15
-			}
-			if entityNames[strings.ToLower(object)] {
-				confidence += 0.15
-			}
-
-			facts = append(facts, ExtractedFact{
-				Subject:    subject,
-				Predicate:  vp.predicate,
-				Object:     object,
-				Confidence: confidence,
-			})
-		}
-	}
-
-	logger.Info("facts extracted", "count", len(facts))
-	return facts, nil
-}
-
-// DetectContradictionsActivity detects contradictions between new facts
-// and existing knowledge. Uses pre-filter to avoid unnecessary comparisons.
-// Stage 4: Returns contradictions with severity and review status.
-func (s *SynthesisActivities) DetectContradictionsActivity(ctx context.Context, project string, facts []ExtractedFact) ([]ContradictionResult, error) {
-	logger := slog.Default()
-	logger.Info("detecting contradictions", "project", project, "fact_count", len(facts))
-
-	contradictions := make([]ContradictionResult, 0)
-
-	for _, fact := range facts {
-		// Query existing facts about the same subject
-		query := fmt.Sprintf("%s %s", fact.Subject, fact.Predicate)
-		results, err := s.memClient.Query(ctx, &memory.QueryRequest{
-			Project:     project,
-			Query:       query,
-			LevelFilter: []string{"L1", "L2"},
-			Floor:       0.7,
-			Limit:       5,
-		})
-		if err != nil {
-			logger.Warn("query for contradictions failed", "error", err, "subject", fact.Subject)
-			continue // Non-fatal: skip this fact
-		}
-
-		for _, r := range results.Results {
-			// Pre-filter: check if result mentions same subject + different object
-			if containsSubject(r.Text, fact.Subject) && contradicts(r.Text, fact) {
-				severity := "low"
-				if r.Score > 0.9 {
-					severity = "high"
-				} else if r.Score > 0.8 {
-					severity = "medium"
-				}
-
-				autoResolved := severity == "low"
-				contradictions = append(contradictions, ContradictionResult{
-					FactA: ExtractedFact{
-						Subject:   fact.Subject,
-						Predicate: fact.Predicate,
-						Object:    r.Text,
-					},
-					FactB:        fact,
-					Severity:     severity,
-					AutoResolved: autoResolved,
-					QueuedReview: !autoResolved,
-				})
-			}
-		}
-	}
-
-	logger.Info("contradictions detected", "count", len(contradictions))
-	return contradictions, nil
-}
-
-// PersistSynthesisActivity saves all synthesis results to the memory service.
-// Stage 5: Persists entities, facts, and queues contradictions for review.
-// Returns error if any persistence fails (fail-safe semantics).
-func (s *SynthesisActivities) PersistSynthesisActivity(ctx context.Context, input PersistInput) error {
-	logger := slog.Default()
-	logger.Info("persisting synthesis results",
-		"chunk_id", input.ChunkID,
-		"entities", len(input.Entities),
-		"facts", len(input.Facts),
-		"contradictions", len(input.Contradictions),
-	)
-
-	var errs []error
-
-	// Persist entities as knowledge records
-	for _, entity := range input.Entities {
-		_, err := s.memClient.Ingest(ctx, &memory.IngestRequest{
-			Project: input.Project,
-			Source:  input.Source,
-			Kind:    "L1",
-			Text:    fmt.Sprintf("Entity: %s (type: %s, confidence: %.2f)", entity.Name, entity.EntityType, entity.Confidence),
-			Metadata: map[string]interface{}{
-				"chunk_id":    input.ChunkID,
-				"entity_type": entity.EntityType,
-				"entity_name": entity.Name,
-			},
-		})
-		if err != nil {
-			logger.Error("failed to persist entity", "entity", entity.Name, "error", err)
-			errs = append(errs, fmt.Errorf("persist entity %s: %w", entity.Name, err))
-		}
-	}
-
-	// Persist facts
-	for _, fact := range input.Facts {
-		_, err := s.memClient.Ingest(ctx, &memory.IngestRequest{
-			Project: input.Project,
-			Source:  input.Source,
-			Kind:    "L1",
-			Text:    fmt.Sprintf("%s %s %s", fact.Subject, fact.Predicate, fact.Object),
-			Metadata: map[string]interface{}{
-				"chunk_id":  input.ChunkID,
-				"subject":   fact.Subject,
-				"predicate": fact.Predicate,
-				"object":    fact.Object,
-			},
-		})
-		if err != nil {
-			logger.Error("failed to persist fact", "subject", fact.Subject, "predicate", fact.Predicate, "error", err)
-			errs = append(errs, fmt.Errorf("persist fact %s %s: %w", fact.Subject, fact.Predicate, err))
-		}
-	}
-
-	// Return all accumulated errors (fail-safe semantics)
-	if len(errs) > 0 {
-		logger.Error("persistence failed with errors", "error_count", len(errs), "chunk_id", input.ChunkID)
-		return fmt.Errorf("persist synthesis: %d errors - %v", len(errs), errs)
-	}
-
-	logger.Info("synthesis persisted successfully", "chunk_id", input.ChunkID)
-	return nil
-}
-
-// --- helpers ---
-
-func isCommonWord(word string) bool {
-	common := map[string]bool{
-		"The": true, "This": true, "That": true, "These": true,
-		"There": true, "When": true, "Where": true, "What": true,
-		"Which": true, "How": true, "But": true, "And": true,
-		"For": true, "Not": true, "You": true, "All": true,
-		"Can": true, "Her": true, "Was": true, "One": true,
-		"Our": true, "Out": true, "Are": true, "Has": true,
-		"Its": true, "May": true, "New": true, "Now": true,
-		"Old": true, "See": true, "Way": true, "Who": true,
-	}
-	return common[word]
-}
-
-func classifyEntity(name string) string {
-	toolPatterns := []string{"Kubernetes", "Docker", "Nginx", "Redis", "Postgres", "ArgoCD", "Terraform", "Helm"}
-	for _, t := range toolPatterns {
-		if strings.EqualFold(name, t) {
-			return "tool"
-		}
-	}
-	return "concept"
-}
-
-func containsSubject(text, subject string) bool {
-	return strings.Contains(strings.ToLower(text), strings.ToLower(subject))
-}
-
-func contradicts(existingText string, newFact ExtractedFact) bool {
-	// Simple heuristic: if existing text mentions subject with a different value
-	// for the same predicate pattern, it might contradict
-	lower := strings.ToLower(existingText)
-	subjectLower := strings.ToLower(newFact.Subject)
-	objectLower := strings.ToLower(newFact.Object)
-
-	// If text mentions subject but NOT the same object, potential contradiction
-	return strings.Contains(lower, subjectLower) && !strings.Contains(lower, objectLower)
-}

activity/synthesis_test.go

@@ -1,183 +0,0 @@
-package activity
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-var testCtx = context.Background()
-
-func TestExtractEntities_WikiLinks(t *testing.T) {
-	sa := NewSynthesisActivities(nil) // No client needed for extraction
-	entities, err := sa.ExtractEntitiesActivity(testCtx, "chunk-1", "Deploy [[Kubernetes]] with [[ArgoCD]]")
-	assert.NoError(t, err)
-
-	names := entityNames(entities)
-	assert.Contains(t, names, "Kubernetes")
-	assert.Contains(t, names, "ArgoCD")
-
-	// Wiki links get high confidence
-	for _, e := range entities {
-		if e.Name == "Kubernetes" || e.Name == "ArgoCD" {
-			assert.Equal(t, 0.95, e.Confidence)
-			assert.Equal(t, "reference", e.EntityType)
-		}
-	}
-}
-
-func TestExtractEntities_ProperNouns(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	entities, err := sa.ExtractEntitiesActivity(testCtx, "chunk-2", "Redis runs on Ubuntu Server")
-	assert.NoError(t, err)
-
-	names := entityNames(entities)
-	assert.Contains(t, names, "Redis")
-	assert.Contains(t, names, "Ubuntu Server")
-}
-
-func TestExtractEntities_TechnicalTerms(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	entities, err := sa.ExtractEntitiesActivity(testCtx, "chunk-3", "Set MAX_RETRIES and use camelCase variables")
-	assert.NoError(t, err)
-
-	names := entityNames(entities)
-	assert.Contains(t, names, "MAX_RETRIES")
-	assert.Contains(t, names, "camelCase")
-}
-
-func TestExtractEntities_Deduplication(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	entities, err := sa.ExtractEntitiesActivity(testCtx, "chunk-4", "[[Redis]] uses Redis for caching")
-	assert.NoError(t, err)
-
-	count := 0
-	for _, e := range entities {
-		if e.Name == "Redis" {
-			count++
-		}
-	}
-	assert.Equal(t, 1, count, "Redis should appear only once")
-}
-
-func TestExtractFacts_VerbPatterns(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	entities := []ExtractedEntity{
-		{Name: "Kubernetes", EntityType: "tool"},
-		{Name: "Docker", EntityType: "tool"},
-	}
-	facts, err := sa.ExtractFactsActivity(testCtx, "chunk-5",
-		"Kubernetes uses Docker for container runtime. Redis depends on TCP",
-		entities)
-	assert.NoError(t, err)
-	assert.Greater(t, len(facts), 0)
-
-	// Find the "uses" fact
-	found := false
-	for _, f := range facts {
-		if f.Predicate == "uses" && f.Subject == "Kubernetes" {
-			found = true
-			assert.Greater(t, f.Confidence, 0.7) // Boosted by known entities
-		}
-	}
-	assert.True(t, found, "should find Kubernetes uses Docker fact")
-}
-
-func TestExtractFacts_EmptyText(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	facts, err := sa.ExtractFactsActivity(testCtx, "chunk-6", "", nil)
-	assert.NoError(t, err)
-	assert.Empty(t, facts)
-}
-
-func TestContradicts(t *testing.T) {
-	assert.True(t, contradicts("Kubernetes uses port 8080", ExtractedFact{
-		Subject: "Kubernetes", Predicate: "uses_port", Object: "9090",
-	}))
-
-	assert.False(t, contradicts("Kubernetes uses port 8080", ExtractedFact{
-		Subject: "Kubernetes", Predicate: "uses_port", Object: "8080",
-	}))
-}
-
-func TestContainsSubject(t *testing.T) {
-	assert.True(t, containsSubject("Kubernetes runs on Linux", "kubernetes"))
-	assert.False(t, containsSubject("Docker runs on Linux", "kubernetes"))
-}
-
-func TestIsCommonWord(t *testing.T) {
-	assert.True(t, isCommonWord("The"))
-	assert.True(t, isCommonWord("This"))
-	assert.False(t, isCommonWord("Kubernetes"))
-	assert.False(t, isCommonWord("Redis"))
-}
-
-func TestClassifyEntity(t *testing.T) {
-	assert.Equal(t, "tool", classifyEntity("Kubernetes"))
-	assert.Equal(t, "tool", classifyEntity("Docker"))
-	assert.Equal(t, "tool", classifyEntity("Redis"))
-	assert.Equal(t, "concept", classifyEntity("SomeRandomThing"))
-}
-
-// --- Tests for ExtractFactsActivity Validation ---
-
-func TestExtractFacts_WithValidation(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	// Test with very long object that should be truncated
-	longText := "Kubernetes uses " + strings.Repeat("very long object name that should be truncated ", 20)
-	entities := []ExtractedEntity{}
-
-	facts, err := sa.ExtractFactsActivity(testCtx, "chunk-1", longText, entities)
-	assert.NoError(t, err)
-
-	// Verify no fact has object > 500 chars
-	for _, f := range facts {
-		assert.LessOrEqual(t, len(f.Object), 500, "object should be truncated to 500 chars")
-	}
-}
-
-func TestExtractFacts_SkipsEmpty(t *testing.T) {
-	sa := NewSynthesisActivities(nil)
-	// Text with empty patterns that would extract nothing
-	text := "Something uses  and other things"
-	entities := []ExtractedEntity{}
-
-	facts, err := sa.ExtractFactsActivity(testCtx, "chunk-1", text, entities)
-	assert.NoError(t, err)
-
-	// Verify no empty facts
-	for _, f := range facts {
-		assert.NotEmpty(t, f.Subject, "subject should not be empty")
-		assert.NotEmpty(t, f.Object, "object should not be empty")
-	}
-}
-
-func TestPersistSynthesis_EmptyInput(t *testing.T) {
-	// Test that empty input is handled (no entities or facts to persist)
-	// Note: This test requires a mock memory service; for now we just test structure
-	input := PersistInput{
-		ChunkID:        "chunk-123",
-		Project:        "test",
-		Source:         "test://1",
-		Kind:           "L1",
-		Entities:       []ExtractedEntity{}, // Empty
-		Facts:          []ExtractedFact{},  // Empty
-		Contradictions: []ContradictionResult{},
-	}
-
-	// Verify input structure is valid
-	assert.Equal(t, "chunk-123", input.ChunkID)
-	assert.Equal(t, 0, len(input.Entities))
-	assert.Equal(t, 0, len(input.Facts))
-}
-
-// helper
-func entityNames(entities []ExtractedEntity) []string {
-	names := make([]string, len(entities))
-	for i, e := range entities {
-		names[i] = e.Name
-	}
-	return names
-}

k8s/configmap.enc.yaml

@@ -1,27 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:IxE=,iv:nh5IQck87AsRYnvxMLxn2rZFBUTHcc9obvsYoHnvC6g=,tag:ink4m5kv1NqX2TeRrpCaqg==,type:str]
-kind: ENC[AES256_GCM,data:2U5oBCqywkR0,iv:EVBlp6G1SlznoP7Zx9Y0mQOnxbzcosP28+UbJUWFjHM=,tag:v1lot4q06QBqU2M5q2RJ/g==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:pFOLyxGAW7/KqUqijkPM1mGYaKo=,iv:jttNW2Ef0itpuWupOQkGEiFaanpcd/HuvfLg9l2tSEg=,tag:6ijOdYdjnUaCOf29z8vkxg==,type:str]
-    namespace: ENC[AES256_GCM,data:FSZFmVEp,iv:liL0yGuEbjZjf6egh8KS9zi6H3AEF9MvynGBO+49GW0=,tag:4iJNECe8vsXqzQBV/Q7c0g==,type:str]
-data:
-    #ENC[AES256_GCM,data:d+Z/w/n69JI5,iv:/w2xIrmNXg53kz+tfebT0P6rD3TC909YTDFXXUc/yHo=,tag:ao4yA2lW2a1/ELT8ZIBOgw==,type:comment]
-    TEMPORAL_NAMESPACE: ENC[AES256_GCM,data:X0D/DVfVgzhFh+oB8nU=,iv:biiLtXRALsUMNIW4qGj8JOc9C1RJK93pOw74ZmymM/g=,tag:tW5+AwUGj8jzvxPSZAf41A==,type:str]
-    TEMPORAL_HOSTPORT: ENC[AES256_GCM,data:OK8Cu7nA2fKhXmBko8MORoD6hvJBMFfE/dTBZ99ac420xjPBWjhrz2XR3WRiWhUIIQ==,iv:HKDNRT/30HNzN3pX91e63i/ZeIUUYkycknjjKTFlVwo=,tag:OjPle4p+nV4ZQYN/yuUFEw==,type:str]
-    #ENC[AES256_GCM,data:1jnEt80ScfSqnCv9Rf/XLAlYTfuZVxoRdV7Sx9EgIGmzvAM=,iv:3NKsB9ZytMxuMipSLApKX7hj2jQG+2e2Hp8+ofFin9k=,tag:s4eRatHTQJa37xBO5UYI5Q==,type:comment]
-    LOCAL_LLM_BASE_URL: ENC[AES256_GCM,data:rTWBhNovjp5WdFI2jMaMRRg41uhh1dOFqVnplmMADiubu/FGXCvUPD2d9IuU,iv:1RdS5UfD6aOXnaEfddRd4PxJ1+K7AwKlMUYxzUQxVJ4=,tag:K0g2KDCFLOtxDFkHxoRbMw==,type:str]
-    MEMORY_SERVICE_URL: ENC[AES256_GCM,data:CarE5ENFtDvBWVzB7qTZQqoL0OsN2uAO9aoPXu1LPWtdoSQ2rQsVs2scTA08jaWLD+o=,iv:e7M/aibmYdSk4NbY6fYw0UPjd/VQvWJ1tC8n0r2y6r0=,tag:bWuCTBRfKkaB2fauPR51Fg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBV0RJU2wzN1Bib0lZRlFl
-            K2UzSVBNUjNHUVVFeUFEWTJBUHNZT0l3RWprCmp2cE1HM2xOWnVjVGlqdWI0SndG
-            Q1VOaklVdlg4eGp6V29uVDVJRUtmKzgKLS0tIGp3MWJMdmdyZmRnWmxOWEhVZUhm
-            Rm5DNzBhUWt0SVBDK09mSWw2SHVRTWMKLS6Cz2nhz1RSoV+VUvFw9EsjlWbE2nEk
-            4P1FdNgr+v1MTNczKZGzh9HbTAmYxCRgVBszXR5ov2JfukaZAWb9mg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-09-06T12:56:33Z"
-    mac: ENC[AES256_GCM,data:Ra89XdYHoJV+uFBlUMdw+I36UQfhM+r0Q4WjI3V/A7jBY2t00I0xSP+KRKPXlAA18HXpLCc5VkWklPMU4gfyYied1bPuFw6yLvvuup/ev4UAg/LofThKjtuRfXPy82Ltvro6R+ilWzJ8pRtgtk+jC4xkkMsUOACJMVwgn979D7M=,iv:UWR+CqXAreW/fx3tt1kJsOKYZkrAkxLXlU5QVy5p3gE=,tag:3t9c6631D4XrDmkR6Iv/4Q==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-config
+  namespace: poimen
+data:
+  TEMPORAL_NAMESPACE: "poimen-harness"
+  TEMPORAL_HOSTPORT: "temporal-frontend.temporal:7233"
+  LOCAL_LLM_BASE_URL: "http://api-gateway.api:8080"
+  POIMEN_MEMORY_URL: "http://poimen-memory.poimen.svc.cluster.local:8080"

k8s/poimen-application.yaml

@@ -0,0 +1,283 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: poimen
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-registry
+  namespace: poimen
+type: kubernetes.io/dockercfg
+data:
+  .dockercfg: eyJmb3JnZWpvLnJpb3RwaWFvLmNvbSI6eyJhdXRoIjoiYmFzZTY0LWVuY29kZWQtY3JlZGVudGlhbHMifX0=
+---
+# Poimen Memory Service
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-memory
+  namespace: poimen
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: poimen-memory
+  template:
+    metadata:
+      labels:
+        app: poimen-memory
+    spec:
+      imagePullSecrets:
+        - name: poimen-registry
+      containers:
+        - name: memory
+          image: forgejo.riotpiao.com/rock/poimen-memory:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8000
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-db-credentials
+                  key: memory-url
+            - name: REDIS_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: redis-url
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-secrets
+                  key: jwt-secret
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: poimen-memory
+  namespace: poimen
+spec:
+  selector:
+    app: poimen-memory
+  ports:
+    - port: 8000
+      targetPort: 8000
+  type: ClusterIP
+---
+# Poimen Workflows Service
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-workflows
+  namespace: poimen
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: poimen-workflows
+  template:
+    metadata:
+      labels:
+        app: poimen-workflows
+    spec:
+      imagePullSecrets:
+        - name: poimen-registry
+      containers:
+        - name: workflows-server
+          image: forgejo.riotpiao.com/rock/poimen-workflows:latest
+          imagePullPolicy: Always
+          command: ["/app/workflows", "server"]
+          ports:
+            - containerPort: 8080
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-db-credentials
+                  key: workflows-url
+            - name: TEMPORAL_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: temporal-host
+            - name: MEMORY_SERVICE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: memory-service-url
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-secrets
+                  key: jwt-secret
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+        - name: workflows-worker
+          image: forgejo.riotpiao.com/rock/poimen-workflows:latest
+          imagePullPolicy: Always
+          command: ["/app/workflows", "worker"]
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-db-credentials
+                  key: workflows-url
+            - name: TEMPORAL_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: temporal-host
+            - name: MEMORY_SERVICE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: memory-service-url
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: poimen-workflows
+  namespace: poimen
+spec:
+  selector:
+    app: poimen-workflows
+  ports:
+    - port: 8080
+      targetPort: 8080
+  type: ClusterIP
+---
+# Poimen Frontend Service
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: poimen-frontend
+  namespace: poimen
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: poimen-frontend
+  template:
+    metadata:
+      labels:
+        app: poimen-frontend
+    spec:
+      imagePullSecrets:
+        - name: poimen-registry
+      containers:
+        - name: frontend
+          image: forgejo.riotpiao.com/rock/poimen-frontend:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+          env:
+            - name: NEXT_PUBLIC_WORKFLOWS_API
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: workflows-api-url
+            - name: NEXT_PUBLIC_MEMORY_API
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: memory-api-url
+            - name: NEXT_PUBLIC_AUTH_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: poimen-config
+                  key: auth-url
+            - name: OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-secrets
+                  key: oauth-client-id
+            - name: OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: poimen-secrets
+                  key: oauth-client-secret
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: poimen-frontend
+  namespace: poimen
+spec:
+  selector:
+    app: poimen-frontend
+  ports:
+    - port: 80
+      targetPort: 3000
+  type: LoadBalancer
+---
+# ConfigMap for shared configuration
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-config
+  namespace: poimen
+data:
+  temporal-host: "temporal:7233"
+  redis-url: "redis://redis:6379"
+  workflows-api-url: "http://poimen-workflows:8080"
+  memory-api-url: "http://poimen-memory:8000"
+  auth-url: "https://auth.riotpiao.com"
+  memory-service-url: "http://poimen-memory:8000"
+---
+# Secrets placeholder - should be created separately
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-db-credentials
+  namespace: poimen
+type: Opaque
+stringData:
+  memory-url: "postgresql://user:pass@postgres:5432/poimen_memory"
+  workflows-url: "postgresql://user:pass@postgres:5432/poimen_workflows"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-secrets
+  namespace: poimen
+type: Opaque
+stringData:
+  jwt-secret: "your-jwt-secret-here"
+  oauth-client-id: "your-oauth-client-id"
+  oauth-client-secret: "your-oauth-client-secret"

k8s/secret.yaml

@@ -0,0 +1,12 @@
+# NOTE: This file is for reference only.
+# Kustomize will auto-generate secrets from secrets.env
+# See kustomization.yaml for details
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-secrets
+  namespace: poimen
+type: Opaque
+stringData:
+  ANTHROPIC_API_KEY: "" # Generated from secrets.env by Kustomize

k8s/secrets.env

@@ -0,0 +1 @@
+ANTHROPIC_API_KEY=YOUR_ANTHROPIC_API_KEY_HERE

pkg/db/db.go

@@ -17,7 +17,7 @@ type DB struct {
 }
 
 // New creates a new database connection to memory-db (K8s CNPG)
-// Expected DSN format: postgresql://app:password@host:5432/dbname?sslmode=disable
+// Expected DSN format: postgresql://app:password@memory-db-rw.poimen.svc.cluster.local:5432/memory?sslmode=disable
 func New(dsn string) (*DB, error) {
 	if dsn == "" {
 		// Fallback: try to construct from K8s env vars

pkg/types/synthesis.go

@@ -1,59 +0,0 @@
-package types
-
-import "time"
-
-// SynthesisInput contains the input for the synthesis workflow.
-type SynthesisInput struct {
-	Project string   `json:"project"`
-	Source  string   `json:"source"`
-	Text    string   `json:"text"`
-	Kind    string   `json:"kind"` // L1, L2, reference
-	Tags    []string `json:"tags,omitempty"`
-}
-
-// SynthesisResult contains the output of the synthesis workflow.
-type SynthesisResult struct {
-	ChunkID            string               `json:"chunk_id"`
-	EntitiesExtracted  int                  `json:"entities_extracted"`
-	FactsExtracted     int                  `json:"facts_extracted"`
-	Contradictions     int                  `json:"contradictions"`
-	ReviewQueued       int                  `json:"review_queued"`
-	Entities           []ExtractedEntity    `json:"entities"`
-	Facts              []ExtractedFact      `json:"facts"`
-	Duration           time.Duration        `json:"duration"`
-}
-
-// ExtractedEntity represents an entity found during synthesis.
-type ExtractedEntity struct {
-	Name       string  `json:"name"`
-	EntityType string  `json:"entity_type"`
-	Confidence float64 `json:"confidence"`
-}
-
-// ExtractedFact represents a fact extracted during synthesis.
-type ExtractedFact struct {
-	Subject    string  `json:"subject"`
-	Predicate  string  `json:"predicate"`
-	Object     string  `json:"object"`
-	Confidence float64 `json:"confidence"`
-}
-
-// ContradictionResult represents a contradiction detection result.
-type ContradictionResult struct {
-	FactA        ExtractedFact `json:"fact_a"`
-	FactB        ExtractedFact `json:"fact_b"`
-	Severity     string        `json:"severity"` // low, medium, high
-	AutoResolved bool          `json:"auto_resolved"`
-	QueuedReview bool          `json:"queued_review"`
-}
-
-// PersistInput groups all synthesis results for persistence.
-type PersistInput struct {
-	ChunkID        string                `json:"chunk_id"`
-	Project        string                `json:"project"`
-	Source         string                `json:"source"`
-	Kind           string                `json:"kind"`
-	Entities       []ExtractedEntity     `json:"entities"`
-	Facts          []ExtractedFact       `json:"facts"`
-	Contradictions []ContradictionResult `json:"contradictions"`
-}

workflow/synthesis.go

@@ -1,125 +0,0 @@
-package workflow
-
-import (
-	"fmt"
-	"time"
-
-	"go.temporal.io/sdk/temporal"
-	"go.temporal.io/sdk/workflow"
-	"github.com/rockliang/poimen/workflows/pkg/types"
-)
-
-// Re-export shared types from pkg/types for backward compatibility
-type SynthesisInput = types.SynthesisInput
-type SynthesisResult = types.SynthesisResult
-type ExtractedEntity = types.ExtractedEntity
-type ExtractedFact = types.ExtractedFact
-type ContradictionResult = types.ContradictionResult
-type PersistInput = types.PersistInput
-
-var synthesisActivityOptions = workflow.ActivityOptions{
-	StartToCloseTimeout: 60 * time.Second,
-	RetryPolicy: &temporal.RetryPolicy{
-		InitialInterval:    time.Second,
-		BackoffCoefficient: 2.0,
-		MaximumInterval:    30 * time.Second,
-		MaximumAttempts:    3,
-	},
-}
-
-// SynthesisWorkflow orchestrates the 4-stage memory synthesis pipeline.
-//
-// Stage 1: Chunk + embed text
-// Stage 2: Extract entities (LLM + reflection)
-// Stage 3: Extract facts (pattern + LLM)
-// Stage 4: Detect contradictions (pre-filter + LLM)
-//
-// Each stage is an activity with independent retry policy.
-func SynthesisWorkflow(ctx workflow.Context, input SynthesisInput) (*SynthesisResult, error) {
-	logger := workflow.GetLogger(ctx)
-	startTime := workflow.Now(ctx)
-
-	logger.Info("synthesis started",
-		"project", input.Project,
-		"source", input.Source,
-		"kind", input.Kind,
-	)
-
-	actCtx := workflow.WithActivityOptions(ctx, synthesisActivityOptions)
-
-	// Stage 1: Chunk + Embed
-	var chunkID string
-	err := workflow.ExecuteActivity(actCtx, "ChunkAndEmbedActivity", input).Get(ctx, &chunkID)
-	if err != nil {
-		return nil, fmt.Errorf("stage 1 chunk+embed: %w", err)
-	}
-	logger.Info("stage 1 complete", "chunk_id", chunkID)
-
-	// Stage 2: Entity Extraction
-	var entities []ExtractedEntity
-	err = workflow.ExecuteActivity(actCtx, "ExtractEntitiesActivity", chunkID, input.Text).Get(ctx, &entities)
-	if err != nil {
-		return nil, fmt.Errorf("stage 2 entity extraction: %w", err)
-	}
-	logger.Info("stage 2 complete", "entities", len(entities))
-
-	// Stage 3: Fact Extraction
-	var facts []ExtractedFact
-	err = workflow.ExecuteActivity(actCtx, "ExtractFactsActivity", chunkID, input.Text, entities).Get(ctx, &facts)
-	if err != nil {
-		return nil, fmt.Errorf("stage 3 fact extraction: %w", err)
-	}
-	logger.Info("stage 3 complete", "facts", len(facts))
-
-	// Stage 4: Contradiction Detection
-	var contradictions []ContradictionResult
-	err = workflow.ExecuteActivity(actCtx, "DetectContradictionsActivity", input.Project, facts).Get(ctx, &contradictions)
-	if err != nil {
-		return nil, fmt.Errorf("stage 4 contradiction detection: %w", err)
-	}
-
-	reviewQueued := 0
-	for _, c := range contradictions {
-		if c.QueuedReview {
-			reviewQueued++
-		}
-	}
-	logger.Info("stage 4 complete", "contradictions", len(contradictions), "review_queued", reviewQueued)
-
-	// Stage 5: Persist results
-	persistInput := PersistInput{
-		ChunkID:        chunkID,
-		Project:        input.Project,
-		Source:         input.Source,
-		Kind:           input.Kind,
-		Entities:       entities,
-		Facts:          facts,
-		Contradictions: contradictions,
-	}
-	err = workflow.ExecuteActivity(actCtx, "PersistSynthesisActivity", persistInput).Get(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("stage 5 persist: %w", err)
-	}
-
-	duration := workflow.Now(ctx).Sub(startTime)
-	result := &SynthesisResult{
-		ChunkID:           chunkID,
-		EntitiesExtracted: len(entities),
-		FactsExtracted:    len(facts),
-		Contradictions:    len(contradictions),
-		ReviewQueued:      reviewQueued,
-		Entities:          entities,
-		Facts:             facts,
-		Duration:          duration,
-	}
-
-	logger.Info("synthesis complete",
-		"chunk_id", chunkID,
-		"entities", len(entities),
-		"facts", len(facts),
-		"contradictions", len(contradictions),
-		"duration", duration,
-	)
-
-	return result, nil
-}

workflow/synthesis_test.go

@@ -1,179 +0,0 @@
-package workflow
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"go.temporal.io/sdk/testsuite"
-)
-
-// Stub activity functions for test registration
-func ChunkAndEmbedActivity(_ context.Context, _ SynthesisInput) (string, error) { return "", nil }
-func ExtractEntitiesActivity(_ context.Context, _ string, _ string) ([]ExtractedEntity, error) { return nil, nil }
-func ExtractFactsActivity(_ context.Context, _ string, _ string, _ []ExtractedEntity) ([]ExtractedFact, error) { return nil, nil }
-func DetectContradictionsActivity(_ context.Context, _ string, _ []ExtractedFact) ([]ContradictionResult, error) { return nil, nil }
-func PersistSynthesisActivity(_ context.Context, _ PersistInput) error { return nil }
-
-func registerSynthesisActivities(env *testsuite.TestWorkflowEnvironment) {
-	env.RegisterActivity(ChunkAndEmbedActivity)
-	env.RegisterActivity(ExtractEntitiesActivity)
-	env.RegisterActivity(ExtractFactsActivity)
-	env.RegisterActivity(DetectContradictionsActivity)
-	env.RegisterActivity(PersistSynthesisActivity)
-}
-
-func TestSynthesisWorkflow_Success(t *testing.T) {
-	ts := &testsuite.WorkflowTestSuite{}
-	env := ts.NewTestWorkflowEnvironment()
-
-	input := SynthesisInput{
-		Project: "poimen",
-		Source:  "transcript://test-123",
-		Text:    "Kubernetes uses port 8080 for the API server",
-		Kind:    "L1",
-	}
-
-	registerSynthesisActivities(env)
-
-	// Stage 1: Chunk + Embed
-	env.OnActivity(ChunkAndEmbedActivity, mock.Anything, input).Return("chunk-abc123", nil)
-
-	// Stage 2: Entity Extraction
-	entities := []ExtractedEntity{
-		{Name: "Kubernetes", EntityType: "tool", Confidence: 0.95},
-		{Name: "API server", EntityType: "component", Confidence: 0.90},
-	}
-	env.OnActivity(ExtractEntitiesActivity, mock.Anything, "chunk-abc123", input.Text).Return(entities, nil)
-
-	// Stage 3: Fact Extraction
-	facts := []ExtractedFact{
-		{Subject: "Kubernetes", Predicate: "uses_port", Object: "8080", Confidence: 0.85},
-	}
-	env.OnActivity(ExtractFactsActivity, mock.Anything, "chunk-abc123", input.Text, entities).Return(facts, nil)
-
-	// Stage 4: Contradiction Detection
-	contradictions := []ContradictionResult{}
-	env.OnActivity(DetectContradictionsActivity, mock.Anything, "poimen", facts).Return(contradictions, nil)
-
-	// Stage 5: Persist
-	env.OnActivity(PersistSynthesisActivity, mock.Anything, mock.Anything).Return(nil)
-
-	env.ExecuteWorkflow(SynthesisWorkflow, input)
-
-	assert.True(t, env.IsWorkflowCompleted())
-	assert.NoError(t, env.GetWorkflowError())
-
-	var result SynthesisResult
-	assert.NoError(t, env.GetWorkflowResult(&result))
-	assert.Equal(t, "chunk-abc123", result.ChunkID)
-	assert.Equal(t, 2, result.EntitiesExtracted)
-	assert.Equal(t, 1, result.FactsExtracted)
-	assert.Equal(t, 0, result.Contradictions)
-	assert.Equal(t, 0, result.ReviewQueued)
-}
-
-func TestSynthesisWorkflow_WithContradictions(t *testing.T) {
-	ts := &testsuite.WorkflowTestSuite{}
-	env := ts.NewTestWorkflowEnvironment()
-	registerSynthesisActivities(env)
-
-	input := SynthesisInput{
-		Project: "poimen",
-		Source:  "transcript://test-456",
-		Text:    "Port 8080 is used by nginx",
-		Kind:    "L1",
-	}
-
-	env.OnActivity(ChunkAndEmbedActivity, mock.Anything, input).Return("chunk-def456", nil)
-
-	entities := []ExtractedEntity{
-		{Name: "nginx", EntityType: "tool", Confidence: 0.92},
-	}
-	env.OnActivity(ExtractEntitiesActivity, mock.Anything, "chunk-def456", input.Text).Return(entities, nil)
-
-	facts := []ExtractedFact{
-		{Subject: "nginx", Predicate: "uses_port", Object: "8080", Confidence: 0.88},
-	}
-	env.OnActivity(ExtractFactsActivity, mock.Anything, "chunk-def456", input.Text, entities).Return(facts, nil)
-
-	contradictions := []ContradictionResult{
-		{
-			FactA:        ExtractedFact{Subject: "Kubernetes", Predicate: "uses_port", Object: "8080"},
-			FactB:        ExtractedFact{Subject: "nginx", Predicate: "uses_port", Object: "8080"},
-			Severity:     "medium",
-			AutoResolved: false,
-			QueuedReview: true,
-		},
-	}
-	env.OnActivity(DetectContradictionsActivity, mock.Anything, "poimen", facts).Return(contradictions, nil)
-	env.OnActivity(PersistSynthesisActivity, mock.Anything, mock.Anything).Return(nil)
-
-	env.ExecuteWorkflow(SynthesisWorkflow, input)
-
-	assert.True(t, env.IsWorkflowCompleted())
-	assert.NoError(t, env.GetWorkflowError())
-
-	var result SynthesisResult
-	assert.NoError(t, env.GetWorkflowResult(&result))
-	assert.Equal(t, 1, result.Contradictions)
-	assert.Equal(t, 1, result.ReviewQueued)
-}
-
-func TestSynthesisWorkflow_EntityExtractionFails(t *testing.T) {
-	ts := &testsuite.WorkflowTestSuite{}
-	env := ts.NewTestWorkflowEnvironment()
-	registerSynthesisActivities(env)
-
-	input := SynthesisInput{
-		Project: "poimen",
-		Source:  "transcript://test-789",
-		Text:    "Some text",
-		Kind:    "L1",
-	}
-
-	env.OnActivity(ChunkAndEmbedActivity, mock.Anything, input).Return("chunk-xyz", nil)
-	env.OnActivity(ExtractEntitiesActivity, mock.Anything, "chunk-xyz", input.Text).
-		Return(nil, assert.AnError)
-
-	env.ExecuteWorkflow(SynthesisWorkflow, input)
-
-	assert.True(t, env.IsWorkflowCompleted())
-	assert.Error(t, env.GetWorkflowError())
-	assert.Contains(t, env.GetWorkflowError().Error(), "stage 2 entity extraction")
-}
-
-func TestSynthesisWorkflow_ChunkFails(t *testing.T) {
-	ts := &testsuite.WorkflowTestSuite{}
-	env := ts.NewTestWorkflowEnvironment()
-	registerSynthesisActivities(env)
-
-	input := SynthesisInput{
-		Project: "poimen",
-		Source:  "transcript://test-fail",
-		Text:    "Bad text",
-		Kind:    "L1",
-	}
-
-	env.OnActivity(ChunkAndEmbedActivity, mock.Anything, input).Return("", assert.AnError)
-
-	env.ExecuteWorkflow(SynthesisWorkflow, input)
-
-	assert.True(t, env.IsWorkflowCompleted())
-	assert.Error(t, env.GetWorkflowError())
-	assert.Contains(t, env.GetWorkflowError().Error(), "stage 1 chunk+embed")
-}
-
-func TestSynthesisInput_Fields(t *testing.T) {
-	input := SynthesisInput{
-		Project: "test",
-		Source:  "source://1",
-		Text:    "hello",
-		Kind:    "L2",
-		Tags:    []string{"tag1", "tag2"},
-	}
-	assert.Equal(t, "test", input.Project)
-	assert.Equal(t, "L2", input.Kind)
-	assert.Len(t, input.Tags, 2)
-}