chore: promote develop to main (README reconcile)

.cursor/rules/no-commit-coauthor.mdc

@@ -0,0 +1,31 @@
+---
+description: Commits and pull requests have one human author. No Cursor co-author trailer.
+alwaysApply: true
+---
+
+# One author on commits
+
+A commit or pull request has one author: the person who asked for it. The message must not contain `Co-authored-by` or `Generated with`.
+
+Passing a clean message is not enough. The commit path can append `Co-authored-by: Cursor <cursoragent@cursor.com>` after the text you supplied. Reviewers read the stored object.
+
+After every `git commit` you create, including a commit inside a submodule, read the stored message:
+
+```sh
+git log -1 --format='%B' | grep -E -i 'co-authored-by|generated with'
+```
+
+No output means the object is clean. Any output means a trailer was injected. When that commit is one you just created and it is not on the remote, amend the message back to the exact text you intended, trailer removed, same tree, no `--no-verify`. Leave a commit that is already pushed alone and say so.
+
+Author and committer stay the person who asked for the commit. Do not set either to Cursor.
+
+```sh
+git commit -m "$(cat <<'EOF'
+fix(scope): what changed
+
+Why it had to change.
+EOF
+)"
+```
+
+The same ban applies to a pull request title and body.

.github/workflows/baas-ci.yml

@@ -1,22 +1,20 @@
 # BaaS CI — fast pre-merge checks for the grobase backend.
 #
-# grobase is now a SEPARATE repo (Univers42/grobase), tracked here as the
-# `apps/grobase` submodule. Its own CI (that repo's .github/workflows/ci.yml) runs
-# the exhaustive image-build + integration + enterprise battery. THIS workflow is
-# the lean superproject gate: it checks out the pinned grobase commit and proves
-# the Go control-plane and the two Rust planes compile + unit-test, plus validates
-# static config. Toolchains run in containers (Docker-first) so no host setup drifts.
+# Each job is one documented Makefile target (subject: single-command / make entrypoints).
+# grobase is a SEPARATE repo (Univers42/grobase), tracked here as apps/grobase.
 name: BaaS CI
 
 on:
   pull_request:
     paths:
       - "apps/grobase"
+      - "utils/mk/baas.mk"
       - ".github/workflows/baas-ci.yml"
   push:
-    branches: ["main", "feat/**", "fix/**", "chore/**"]
+    branches: ["main", "develop", "feat/**", "fix/**", "chore/**"]
     paths:
       - "apps/grobase"
+      - "utils/mk/baas.mk"
       - ".github/workflows/baas-ci.yml"
   workflow_dispatch:
 
@@ -26,7 +24,7 @@ concurrency:
 
 jobs:
   go:
-    name: Go control-plane (vet + test)
+    name: Go control-plane (make baas-ci-go)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -39,13 +37,11 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - name: vet + test (containerised toolchain)
-        run: |
-          docker run --rm -v "$PWD/apps/grobase/src/control-plane:/src" -w /src \
-            golang:1.25-bookworm sh -c "go vet ./... && go test ./..."
+      - name: make baas-ci-go
+        run: make baas-ci-go
 
   rust-data-plane:
-    name: Rust data-plane (test)
+    name: Rust data-plane (make baas-ci-rust-data-plane)
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
@@ -58,14 +54,11 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - name: cargo test --workspace
-        run: |
-          docker run --rm -e CARGO_NET_RETRY=10 -e CARGO_HTTP_MULTIPLEXING=false \
-            -v "$PWD/apps/grobase/src/data-plane-router:/src" -w /src \
-            rust:1-bookworm cargo test --workspace
+      - name: make baas-ci-rust-data-plane
+        run: make baas-ci-rust-data-plane
 
   rust-realtime:
-    name: Rust realtime (test)
+    name: Rust realtime (make baas-ci-rust-realtime)
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
@@ -78,14 +71,11 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - name: cargo test --workspace
-        run: |
-          docker run --rm -e CARGO_NET_RETRY=10 -e CARGO_HTTP_MULTIPLEXING=false \
-            -v "$PWD/apps/grobase/infra/docker/services/realtime/realtime-agnostic:/src" -w /src \
-            rust:1-bookworm cargo test --workspace
+      - name: make baas-ci-rust-realtime
+        run: make baas-ci-rust-realtime
 
   static:
-    name: Static config (manifest parity + Prometheus rules)
+    name: Static config (make baas-ci-static)
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -98,18 +88,5 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - name: package manifest parity (config == Go-embedded copy)
-        working-directory: apps/grobase
-        run: |
-          diff <(jq -S . infra/config/packages/packages.json) \
-               <(jq -S . src/control-plane/internal/packages/packages.json) \
-            && echo "package manifest is the single source of truth"
-      - name: Prometheus rules + config (m52)
-        working-directory: apps/grobase
-        run: |
-          docker run --rm --entrypoint promtool \
-            -v "$PWD/infra/config/prometheus":/etc/prometheus \
-            prom/prometheus:v2.52.0 check config /etc/prometheus/prometheus.yml
-      - name: shellcheck verify gates (advisory)
-        working-directory: apps/grobase
-        run: shellcheck -S error scripts/verify/m*.sh || true
+      - name: make baas-ci-static
+        run: make baas-ci-static

LICENSE

@@ -4,12 +4,16 @@ Copyright (c) 2026 Osionos contributors.
 
 All rights reserved.
 
-This repository and all of its contents, including but not limited to source code,
+This repository's own files, including but not limited to source code,
 configuration files, scripts, documentation, assets, examples, schemas, database
 migrations, Docker files, and related materials, are the exclusive property of the
 copyright holders and are protected by copyright law and other applicable
 intellectual property laws.
 
+This license does not cover the git submodules listed in .gitmodules (under apps/,
+vendor/ and .claude/). Each submodule keeps its own license; for example,
+apps/grobase is licensed under the GNU Affero General Public License v3.0.
+
 Permission is granted only to the contributors to this project and to persons
 explicitly authorized by the copyright holders to access, inspect, run, and
 contribute to the software for the limited purpose of evaluating, developing,