Establish a safe foundation before implementing the geology RAG system

The project begins with architecture, data governance, reproducible evaluation, deployment boundaries, and secret-handling contracts so later code has measurable acceptance criteria.

Constraint: Real provider credentials, workspace identities, and restricted geological data must never enter Git

Rejected: Add placeholder runnable services in the design commit | would imply unverified implementation readiness

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Run make verify before every commit and update ADRs when architecture boundaries change

Tested: Secret scan, Markdown links, YAML parse, shell syntax, and staged diff validation

Not-tested: Application runtime is intentionally deferred to the implementation stage

Makefile

@@ -0,0 +1,25 @@
+.PHONY: setup-hooks check-secrets docs-check links-check verify-design verify
+
+setup-hooks:
+	git config core.hooksPath .githooks
+	chmod +x .githooks/pre-commit scripts/check-secrets.sh
+
+check-secrets:
+	./scripts/check-secrets.sh --all
+
+docs-check:
+	test -f docs/00-overall-design.md
+	test -f docs/01-data-and-evaluation.md
+	test -f docs/02-deployment-and-security.md
+	test -f docs/03-implementation-plan.md
+
+links-check:
+	python3 scripts/check_markdown_links.py
+
+verify-design: check-secrets docs-check links-check
+	git diff --check
+	git diff --cached --check
+
+# During the design stage this aliases the design checks. Implementation stages
+# must extend it with backend/frontend lint, types, tests, and image checks.
+verify: verify-design