feat(webapp): custom domain support, social graph assets & hardened sync prompt

.github/prompts/align-cli-webapp-reports.prompt.md

@@ -1,38 +1,40 @@
 ---
-description: Compare CLI visual readiness report with local webapp report for a given repo, identify differences in checks/rendering/scoring, and fix them
+description: Compare CLI visual readiness report with local webapp report for a given repo, identify rendering/scoring differences, and fix them in the webapp only
 ---
 
 You are debugging consistency between two readiness report outputs for the **AgentRC** project:
 
 1. **CLI visual report** — generated by `npm run dev -- readiness --visual` from the repo root (produces an HTML file)
 2. **Webapp report** — rendered by the local dev server at `http://localhost:3000/{owner}/{repo}`
 
-Both should produce identical results for the same repository because they share the same core engine (`packages/core/src/services/readiness.ts`). In practice they can diverge due to rendering differences or scoring logic bugs.
+Both should produce identical results for the same repository because they share the same core engine (`packages/core/src/services/readiness.ts`). In practice the webapp rendering can diverge from the CLI due to its independent rendering logic.
+
+> **IMPORTANT CONSTRAINT**: The CLI report and `packages/core/` are the **source of truth**. All fixes MUST be made exclusively in the `webapp/` directory (frontend and/or backend). **Never modify files in `packages/core/` or `src/`** — if the webapp disagrees with the CLI, the webapp is wrong.
 
 ## Architecture Reference
 
-### Shared Core (source of truth for checks)
+### Shared Core (source of truth — DO NOT MODIFY)
 
 - `packages/core/src/services/readiness.ts` — All criteria definitions, `countStatus()`, `buildCriteria()`, `buildExtras()`, pillar/level aggregation
 - Criteria scopes: `repo` (always), `app` (per-application), `area` (only with `--per-area`)
 - `countStatus()` **excludes** skipped checks from the denominator when computing pillar pass/total
 - Extras (bonus checks) are **not scored** — they don't affect levels or totals
 
-### CLI Rendering
+### CLI Rendering (source of truth — DO NOT MODIFY)
 
 - `packages/core/src/services/visualReport.ts` — Generates the standalone HTML report
 - `calculateAiToolingData()` — Aggregates AI criteria across repos (counts all including skipped in the hero display)
 - Total checks: `report.pillars.reduce((s, p) => s + p.total, 0)`
 - Does **not** render bonus/extras section in HTML output
 
-### Webapp Backend
+### Webapp Backend (fix here if needed)
 
 - `webapp/backend/src/services/scanner.js` — Clones repo, calls `runReadinessReport()` from `@agentrc/core`
 - `webapp/backend/src/routes/scan.js` — `POST /api/scan` endpoint
 - Returns the raw `ReadinessReport` JSON (same shape as CLI)
 - Uses `@agentrc/core` as a `file:../../packages/core` dependency — always uses local source code
 
-### Webapp Frontend
+### Webapp Frontend (fix here if needed)
 
 - `webapp/frontend/src/report.js` — Independent rendering implementation (NOT shared with CLI)
 - `buildHero()` — Total from `report.pillars.reduce((s, p) => s + p.total, 0)`
@@ -49,32 +51,46 @@ Both should produce identical results for the same repository because they share
 
 ## Step-by-Step Procedure
 
-### Phase 0: Start Local Webapp
+### Phase 0: Sync & Start Local Webapp
+
+1. Pull the latest changes from upstream to ensure you're working against the current source of truth:
 
-1. Start the webapp backend dev server (from the repo root):
+   ```
+   git fetch upstream && git merge upstream/main
+   ```
+
+   If the workspace uses a different default branch or remote name, adjust accordingly. Resolve any merge conflicts before proceeding.
+
+2. Install dependencies in case they changed:
+
+   ```
+   npm install
+   ```
+
+3. Start the webapp backend dev server (from the repo root):
 
    ```
    cd webapp/backend && npm run dev
    ```
 
    This starts the Express server at `http://localhost:3000` with the local `@agentrc/core` source.
 
-2. Optionally serve the frontend for full visual testing:
+4. Optionally serve the frontend for full visual testing:
    ```
    cd webapp/frontend && npx vite --port 5173
    ```
 
 ### Phase 1: Generate Both Reports
 
-3. Run the CLI against the target repo to produce the visual HTML report:
+5. Run the CLI against the target repo to produce the visual HTML report:
 
    ```
    npm run dev -- readiness --visual --repo {owner}/{repo}
    ```
 
    Save the output HTML (typically `readiness-report.html`).
 
-4. Hit the local webapp API to get the raw JSON:
+6. Hit the local webapp API to get the raw JSON:
 
    ```
    POST http://localhost:3000/api/scan
@@ -87,13 +103,13 @@ Both should produce identical results for the same repository because they share
    $response = Invoke-RestMethod -Uri "http://localhost:3000/api/scan" -Method POST -ContentType "application/json" -Body '{"repo_url":"https://github.com/{owner}/{repo}"}' -TimeoutSec 120
    ```
 
-5. Also open the local webapp page for visual comparison: `http://localhost:5173/{owner}/{repo}` (if frontend dev server is running) or `http://localhost:3000/{owner}/{repo}` (if backend serves static files).
+7. Also open the local webapp page for visual comparison: `http://localhost:5173/{owner}/{repo}` (if frontend dev server is running) or `http://localhost:3000/{owner}/{repo}` (if backend serves static files).
 
 ### Phase 2: Compare Data Layer
 
-6. Extract from CLI HTML: total checks, per-pillar passed/total, AI hero passed/total/percentage, criteria list with statuses, achieved level, fix-first items.
+8. Extract from CLI HTML: total checks, per-pillar passed/total, AI hero passed/total/percentage, criteria list with statuses, achieved level, fix-first items.
 
-7. Extract from webapp JSON: same fields. Use:
+9. Extract from webapp JSON: same fields. Use:
 
    ```powershell
    $pillars = $response.pillars
@@ -103,46 +119,50 @@ Both should produce identical results for the same repository because they share
    Write-Host "Criteria count: $($response.criteria.Count)"
    ```
 
-8. Diff the two — check for:
-   - **Missing criteria** in either side (criteria list length mismatch)
-   - **Status mismatches** for the same criterion ID
-   - **Total check count** differences (pillar aggregation)
-   - **AI Tooling hero** percentage/label differences
-   - **Achieved level** and next-level calculation differences
-   - **Fix-first** list ordering differences
+10. Diff the two — check for:
+
+- **Missing criteria** in either side (criteria list length mismatch)
+- **Status mismatches** for the same criterion ID
+- **Total check count** differences (pillar aggregation)
+- **AI Tooling hero** percentage/label differences
+- **Achieved level** and next-level calculation differences
+- **Fix-first** list ordering differences
 
 ### Phase 3: Compare Rendering Layer
 
-9. Compare how both renderers handle:
-   - Skipped checks display (icon, text, inclusion in totals)
-   - Bonus/extras section presence
-   - Pillar grouping (repo-health vs ai-setup)
-   - AI criterion icons for new/unknown IDs
-   - Score thresholds for labels (Excellent/Good/Fair/Getting Started/Not Started)
+11. Compare how both renderers handle:
+
+- Skipped checks display (icon, text, inclusion in totals)
+- Bonus/extras section presence
+- Pillar grouping (repo-health vs ai-setup)
+- AI criterion icons for new/unknown IDs
+- Score thresholds for labels (Excellent/Good/Fair/Getting Started/Not Started)
 
 ### Phase 4: Root Cause & Fix
 
-10. For each difference found, classify as:
-    - **Rendering divergence** → Fix in either `visualReport.ts` (CLI) or `report.js` (webapp) to align
-    - **Scoring logic bug** → Fix in `readiness.ts` (core) which fixes both
-    - **Icon/label mapping gap** → Update the icon map in the affected renderer
+> **Reminder**: The CLI and `packages/core/` are the source of truth. All fixes go in `webapp/` only.
+
+12. For each difference found, classify as:
+    - **Rendering divergence** → Fix in `webapp/frontend/src/report.js` to match CLI behavior
+    - **Scoring logic divergence** → Fix in `webapp/backend/` or `webapp/frontend/` to align with core's scoring
+    - **Icon/label mapping gap** → Update the icon/label map in `webapp/frontend/src/report.js`
 
-11. Implement the fixes directly in the source files.
+13. Implement the fixes directly in the `webapp/` source files. **Never edit** files in `packages/core/`, `src/`, or any other directory outside `webapp/`.
 
-12. After fixing, restart the webapp dev server and re-run Phase 1-2 to verify alignment.
+14. After fixing, restart the webapp dev server and re-run Phase 1-2 to verify alignment.
 
 ### Phase 5: Validate
 
-13. Confirm both reports show identical:
+15. Confirm both reports show identical:
     - Total check count (e.g., "11 of 20")
     - Per-pillar passed/total
     - AI Tooling hero percentage and label
     - Achieved maturity level
     - Fix-first items (same set, same order)
 
-14. Note any **acceptable differences** that are by-design (e.g., webapp shows bonus checks, CLI doesn't).
+16. Note any **acceptable differences** that are by-design (e.g., webapp shows bonus checks, CLI doesn't).
 
-15. Run existing tests to ensure no regressions:
+17. Run existing tests to ensure no regressions:
     ```
     npm test
     cd webapp/backend && npm test

.github/workflows/webapp-cd.yml

@@ -22,7 +22,7 @@ permissions:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/agentrc-webapp
-  RESOURCE_GROUP: agentrc-webapp-rg
+  RESOURCE_GROUP: agentrc-webapp
   BICEP_FILE: infra/webapp/main.bicep
 
 jobs:
@@ -133,14 +133,30 @@ jobs:
             2>&1 || echo "Storage mount does not exist yet"
           sleep 10
 
-      - name: Deploy infrastructure
+      - name: Deploy infrastructure (step 1 — app + domain registration)
         uses: azure/arm-deploy@v2
         with:
           resourceGroupName: ${{ env.RESOURCE_GROUP }}
           template: ${{ env.BICEP_FILE }}
           parameters: >
             containerImageTag=${{ needs.build-push.outputs.image-tag }}
             ghTokenForScan=${{ secrets.GH_TOKEN_FOR_SCAN }}
+            useAcrAdminCredentials=${{ vars.USE_ACR_ADMIN_CREDENTIALS == 'true' }}
+            customDomain=${{ vars.CUSTOM_DOMAIN || '' }}
+            customDomainCertReady=false
+
+      - name: Deploy infrastructure (step 2 — bind managed certificate)
+        if: vars.CUSTOM_DOMAIN && vars.CUSTOM_DOMAIN_CERT_READY == 'true'
+        uses: azure/arm-deploy@v2
+        with:
+          resourceGroupName: ${{ env.RESOURCE_GROUP }}
+          template: ${{ env.BICEP_FILE }}
+          parameters: >
+            containerImageTag=${{ needs.build-push.outputs.image-tag }}
+            ghTokenForScan=${{ secrets.GH_TOKEN_FOR_SCAN }}
+            useAcrAdminCredentials=${{ vars.USE_ACR_ADMIN_CREDENTIALS == 'true' }}
+            customDomain=${{ vars.CUSTOM_DOMAIN || '' }}
+            customDomainCertReady=true
 
       - name: Ensure image in ACR
         run: |
@@ -176,3 +192,10 @@ jobs:
           curl -sf "https://${APP_URL}/api/health" | grep -q '"ok"'
           curl -sf "https://${APP_URL}/" | grep -q "AgentRC"
           echo "Smoke tests passed!"
+
+          CUSTOM_DOMAIN="${{ vars.CUSTOM_DOMAIN }}"
+          if [ -n "$CUSTOM_DOMAIN" ] && [ "${{ vars.CUSTOM_DOMAIN_CERT_READY }}" = "true" ]; then
+            echo "Testing custom domain https://${CUSTOM_DOMAIN}"
+            curl -sf "https://${CUSTOM_DOMAIN}/api/health" | grep -q '"ok"'
+            echo "Custom domain smoke test passed!"
+          fi

Dockerfile.webapp

@@ -22,7 +22,7 @@ COPY webapp/backend/package.json ./package.json
 COPY --from=deps /app/webapp/backend/node_modules ./node_modules
 COPY --from=deps /app/node_modules /app/node_modules
 COPY --from=build /app/webapp/backend/dist ./dist
-COPY webapp/frontend/ /app/frontend/
+COPY webapp/frontend/ /app/webapp/frontend/
 ENV REPORTS_DIR=/app/data/reports
 RUN mkdir -p /app/data \
   && chown -R node:node /app