Move CI workflows to repo root .gitea/workflows/ (Gitea requires root location)

- 6 per-product CI workflows with path filters
- P1: Rust (cargo test + clippy + fmt)
- P2: Go agent (go test + vet) + Node SaaS (tsc + npm test)
- P3-P6: Node (npm ci + tsc + npm test)
- Removed old per-product .gitea dirs (Gitea ignores non-root workflows)

.gitea/workflows/ci-p1-route.yml

@@ -1,12 +1,14 @@
-name: CI
+name: CI — P1 Route (Rust)
 on:
   push:
     branches: [main]
+    paths: ['products/01-llm-cost-router/**']
   pull_request:
+    paths: ['products/01-llm-cost-router/**']
 
 jobs:
   test:
-    runs-on: ubuntu-latest  # Gitea runner on NAS
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -20,7 +22,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('products/01-llm-cost-router/Cargo.lock') }}
 
       - name: Run tests
         run: cargo test --workspace
@@ -33,24 +35,3 @@ jobs:
       - name: Format check
         run: cargo fmt --check
         working-directory: products/01-llm-cost-router
-
-  ui-build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Install deps
-        run: npm ci
-        working-directory: products/01-llm-cost-router/ui
-
-      - name: Type check
-        run: npx tsc --noEmit
-        working-directory: products/01-llm-cost-router/ui
-
-      - name: Build
-        run: npm run build
-        working-directory: products/01-llm-cost-router/ui

.gitea/workflows/ci-p2-drift.yml

@@ -1,11 +1,13 @@
-name: CI
+name: CI — P2 Drift (Go + Node)
 on:
   push:
     branches: [main]
+    paths: ['products/02-iac-drift-detection/**']
   pull_request:
+    paths: ['products/02-iac-drift-detection/**']
 
 jobs:
-  agent-test:
+  agent:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -22,7 +24,7 @@ jobs:
         run: go vet ./...
         working-directory: products/02-iac-drift-detection/agent
 
-  saas-test:
+  saas:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -42,21 +44,3 @@ jobs:
       - name: Test
         run: npm test
         working-directory: products/02-iac-drift-detection/saas
-
-  agent-build:
-    runs-on: ubuntu-latest
-    needs: agent-test
-    if: github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-
-      - name: Build agent binaries
-        run: |
-          GOOS=linux GOARCH=amd64 go build -o dist/drift-linux-amd64 ./cmd/drift
-          GOOS=darwin GOARCH=arm64 go build -o dist/drift-darwin-arm64 ./cmd/drift
-          GOOS=windows GOARCH=amd64 go build -o dist/drift-windows-amd64.exe ./cmd/drift
-        working-directory: products/02-iac-drift-detection/agent

.gitea/workflows/ci-p3-alert.yml

@@ -1,8 +1,10 @@
-name: CI
+name: CI — P3 Alert
 on:
   push:
     branches: [main]
+    paths: ['products/03-alert-intelligence/**']
   pull_request:
+    paths: ['products/03-alert-intelligence/**']
 
 jobs:
   test:

.gitea/workflows/ci-p4-portal.yml

@@ -1,8 +1,10 @@
-name: CI
+name: CI — P4 Portal
 on:
   push:
     branches: [main]
+    paths: ['products/04-lightweight-idp/**']
   pull_request:
+    paths: ['products/04-lightweight-idp/**']
 
 jobs:
   test:

.gitea/workflows/ci-p5-cost.yml

@@ -1,8 +1,10 @@
-name: CI
+name: CI — P5 Cost
 on:
   push:
     branches: [main]
+    paths: ['products/05-aws-cost-anomaly/**']
   pull_request:
+    paths: ['products/05-aws-cost-anomaly/**']
 
 jobs:
   test:

.gitea/workflows/ci-p6-run.yml

@@ -1,27 +1,13 @@
-name: CI
+name: CI — P6 Run
 on:
   push:
     branches: [main]
+    paths: ['products/06-runbook-automation/**']
   pull_request:
+    paths: ['products/06-runbook-automation/**']
 
 jobs:
-  agent-test:
+  saas:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Test agent
-        run: cargo test
-        working-directory: products/06-runbook-automation/agent
-
-      - name: Clippy
-        run: cargo clippy -- -D warnings
-        working-directory: products/06-runbook-automation/agent
-
-  saas-test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

products/01-llm-cost-router/.gitea/workflows/benchmark.yml

@@ -1,30 +0,0 @@
-name: Latency Benchmark
-on:
-  push:
-    branches: [main]
-    paths: ['products/01-llm-cost-router/src/proxy/**']
-
-jobs:
-  benchmark:
-    runs-on: ubuntu-latest  # Gitea runner on NAS — consistent CPU
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: dtolnay/rust-toolchain@stable
-
-      - name: Run proxy latency benchmark
-        run: cargo bench --bench proxy_latency 2>&1 | tee bench-output.txt
-        working-directory: products/01-llm-cost-router
-
-      - name: Assert P99 < 5ms
-        run: |
-          # Extract P99 from criterion output
-          P99=$(grep -oP 'median\s+\K[\d.]+' bench-output.txt | head -1 || echo "0")
-          echo "P99 latency: ${P99}ns"
-          # 5ms = 5,000,000ns
-          if [ "$(echo "$P99 > 5000000" | bc -l 2>/dev/null || echo 0)" = "1" ]; then
-            echo "❌ P99 latency ${P99}ns exceeds 5ms budget"
-            exit 1
-          fi
-          echo "✅ P99 within budget"
-        working-directory: products/01-llm-cost-router

products/01-llm-cost-router/.gitea/workflows/deploy.yml

@@ -1,58 +0,0 @@
-name: Deploy
-on:
-  push:
-    branches: [main]
-    paths: ['products/01-llm-cost-router/src/**', 'products/01-llm-cost-router/Cargo.*']
-
-jobs:
-  deploy-proxy:
-    runs-on: ubuntu-latest
-    needs: []
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: superfly/flyctl-actions/setup-flyctl@master
-
-      - name: Deploy proxy to Fly.io
-        run: flyctl deploy --config fly.proxy.toml --remote-only
-        working-directory: products/01-llm-cost-router
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-
-  deploy-api:
-    runs-on: ubuntu-latest
-    needs: []
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: superfly/flyctl-actions/setup-flyctl@master
-
-      - name: Deploy API to Fly.io
-        run: flyctl deploy --config fly.api.toml --remote-only
-        working-directory: products/01-llm-cost-router
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-
-  deploy-ui:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Build UI
-        run: |
-          cd products/01-llm-cost-router/ui
-          npm ci
-          npm run build
-
-      - name: Deploy to Cloudflare Pages
-        run: |
-          npx wrangler pages deploy products/01-llm-cost-router/ui/dist \
-            --project-name=dd0c-route \
-            --branch=main
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

products/02-iac-drift-detection/.gitea/workflows/ci-saas.yml

@@ -1,31 +0,0 @@
-name: CI - SaaS
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'products/02-iac-drift-detection/saas/**'
-  pull_request:
-    paths:
-      - 'products/02-iac-drift-detection/saas/**'
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Install deps
-        run: npm ci
-        working-directory: products/02-iac-drift-detection/saas
-
-      - name: Type check
-        run: npx tsc --noEmit
-        working-directory: products/02-iac-drift-detection/saas
-
-      - name: Test
-        run: npm test
-        working-directory: products/02-iac-drift-detection/saas

products/02-iac-drift-detection/.gitea/workflows/deploy.yml

@@ -1,19 +0,0 @@
-name: Deploy
-on:
-  push:
-    branches: [main]
-    paths: ['products/02-iac-drift-detection/saas/**']
-
-jobs:
-  deploy-saas:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: superfly/flyctl-actions/setup-flyctl@master
-
-      - name: Deploy SaaS to Fly.io
-        run: flyctl deploy --config fly.toml --remote-only
-        working-directory: products/02-iac-drift-detection/saas
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

products/marketing/site/src/pages/alert.astro

@@ -4,7 +4,7 @@ import Footer from '../components/Footer.astro';
 import CTA from '../components/CTA.astro';
 ---
 
-<Layout title="dd0c/alert — Alert Intelligence" description="Correlate alerts from PagerDuty, Datadog, OpsGenie into incidents. Cut alert noise by 80%.">
+<Layout title="dd0c/alert — Alert Intelligence & Correlation" description="Correlate alerts from PagerDuty, Datadog, OpsGenie, and Grafana into incidents. Reduce alert fatigue by 80%. BigPanda alternative for small teams. HMAC-verified webhooks.">
   <section class="pt-32 pb-20 px-6">
     <div class="max-w-4xl mx-auto">
       <div class="mb-8">

products/marketing/site/src/pages/drift.astro

@@ -4,7 +4,7 @@ import Footer from '../components/Footer.astro';
 import CTA from '../components/CTA.astro';
 ---
 
-<Layout title="dd0c/drift — IaC Drift Detection" description="Lightweight Terraform drift detection agent. Scans state, scrubs secrets, alerts on Slack. No ClickOps surprises.">
+<Layout title="dd0c/drift — Terraform Drift Detection" description="Lightweight Go agent detects Terraform state drift, scrubs secrets from reports, and alerts on Slack. Driftctl alternative for IaC drift management. Self-hosted or SaaS.">
   <section class="pt-32 pb-20 px-6">
     <div class="max-w-4xl mx-auto">
       <div class="mb-8">

products/marketing/site/src/pages/portal.astro

@@ -4,7 +4,7 @@ import Footer from '../components/Footer.astro';
 import CTA from '../components/CTA.astro';
 ---
 
-<Layout title="dd0c/portal — Service Catalog" description="Auto-discover services from AWS and GitHub. Know who owns what. Lightweight Backstage alternative.">
+<Layout title="dd0c/portal — Lightweight Service Catalog & Developer Portal" description="Auto-discover services from AWS and GitHub. Ownership resolution via CODEOWNERS and tags. Meilisearch-powered search. Backstage alternative you can set up before lunch.">
   <section class="pt-32 pb-20 px-6">
     <div class="max-w-4xl mx-auto">
       <div class="mb-8">

products/marketing/site/src/pages/route.astro

@@ -4,7 +4,7 @@ import Footer from '../components/Footer.astro';
 import CTA from '../components/CTA.astro';
 ---
 
-<Layout title="dd0c/route — LLM Cost Router" description="Route AI API calls to the cheapest provider. Set cost caps. Get usage dashboards. Stop overpaying for GPT-4.">
+<Layout title="dd0c/route — LLM Cost Router & Dashboard" description="Route AI API calls to the cheapest provider. Drop-in OpenAI proxy with cost-based routing, real-time dashboards, and budget alerts. LiteLLM alternative with sub-ms Rust latency.">
   <section class="pt-32 pb-20 px-6">
     <div class="max-w-4xl mx-auto">
       <div class="mb-8">