kl3inIT · kl3inIT · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/docs/guidelines/frontend-design-system.md b/docs/guidelines/frontend-design-system.md
@@ -16,3 +16,24 @@ Required qualities:
 
 Do not copy old page layouts merely to preserve route parity. Reuse old code only
 when it is generic, tested, and compatible with the new information architecture.
+
+## Foundation Boundary
+
+- `main.tsx` owns process-level providers and the final React crash boundary.
+- TanStack Router owns route pending, route error, not-found, typed search, and
+  route-level code splitting.
+- TanStack Query owns server state. Initial failures render in context; only
+  failed background refreshes produce a global toast.
+- The browser session is the authenticated-shell gate. Product routes must not
+  render before the session is verified.
+- Ordinary REST clients are generated from root `contracts/openapi.json` with
+  Hey API. AI streaming remains a separate transport boundary.
+- Raw exception text is development-only. Production states use safe messages
+  and an explicit retry path.
+
+## Retained Building Blocks
+
+Keep shadcn/ui registry primitives and the AI Elements foundation even while a
+screen is not implemented. They are local product building blocks, not evidence
+that the corresponding product feature already exists. Add product routes one
+vertical slice at a time; do not restore the deleted prototype pages.
diff --git a/docs/increments/active/2026-07-20-secure-knowledge-vertical-slice/plan.md b/docs/increments/active/2026-07-20-secure-knowledge-vertical-slice/plan.md
@@ -61,10 +61,12 @@
 
 ## 7 — Minimal New Web Flow
 
-- [ ] Add new shell and semantic light/dark tokens.
-- [ ] Export OpenAPI and generate typed fetch/Zod/TanStack clients; keep the AI
+- [x] Add new shell and semantic light/dark tokens.
+- [x] Export OpenAPI and generate typed fetch/Zod/TanStack clients; keep the AI
   streaming transport separate from ordinary REST contracts.
-- [ ] Add oxlint, Vitest, and one critical Playwright project before expanding UI.
+- [x] Add oxlint with React/TypeScript correctness rules and generated/registry
+  exclusions.
+- [ ] Add Vitest and one critical Playwright project before expanding UI.
 - [ ] Build Ask with visible waiting/tool/evidence/citation/error states.
 - [ ] Build Sources upload/status/privacy view and Review publication view.
 - [ ] Run real-browser two-user upload, answer, deny, and revoke flow.

diff --git a/web/.oxlintrc.json b/web/.oxlintrc.json
@@ -0,0 +1,17 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["react", "typescript", "oxc"],
+  "ignorePatterns": ["dist", "src/components/ui", "src/components/ai-elements", "src/lib/hey-api"],
+  "rules": {
+    "react/rules-of-hooks": "error",
+    "react/only-export-components": ["warn", { "allowConstantExport": true }]
+  },
+  "overrides": [
+    {
+      "files": ["src/main.tsx", "src/router.tsx"],
+      "rules": {
+        "react/only-export-components": "off"
+      }
+    }
+  ]
+}
diff --git a/web/index.html b/web/index.html
@@ -3,7 +3,9 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="icon" href="data:," />
+    <meta name="description" content="Permission-aware enterprise knowledge and AI search." />
+    <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#252525" media="(prefers-color-scheme: dark)" />
     <title>OrgMemory</title>
   </head>
   <body>

diff --git a/web/package.json b/web/package.json
@@ -6,32 +6,31 @@
   "scripts": {
     "dev": "vite",
     "gen:api": "corepack pnpm dlx --package @hey-api/openapi-ts@0.99.0 --package typescript@6.0.1-rc openapi-ts -i ../contracts/openapi.json -o src/lib/hey-api -c @hey-api/client-fetch -p @hey-api/typescript @hey-api/sdk @tanstack/react-query zod",
-    "build": "corepack pnpm gen:api && tsc -b && vite build",
+    "build": "corepack pnpm gen:api && corepack pnpm lint && tsc -b && vite build",
+    "lint": "oxlint",
     "typecheck": "corepack pnpm gen:api && tsc -b",
     "preview": "vite preview"
   },
   "dependencies": {
     "@ai-sdk/react": "^4.0.34",
+    "@radix-ui/react-slot": "^1.3.0",
     "@streamdown/cjk": "^1.0.3",
     "@streamdown/code": "^1.1.1",
     "@streamdown/math": "^1.0.2",
     "@streamdown/mermaid": "^1.0.2",
     "@tanstack/react-query": "^5.101.2",
-    "@tanstack/react-query-devtools": "^5.101.2",
     "@tanstack/react-router": "^1.170.18",
-    "@xyflow/react": "^12.11.2",
     "ai": "^7.0.31",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "cytoscape": "^3.34.0",
-    "cytoscape-fcose": "^2.2.0",
     "lucide-react": "^1.25.0",
     "nanoid": "^6.0.0",
     "next-themes": "^0.4.6",
     "radix-ui": "^1.6.3",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
+    "react-error-boundary": "^6.1.2",
     "recharts": "^3.9.2",
     "sonner": "^2.0.7",
     "streamdown": "^2.5.0",
@@ -41,10 +40,12 @@
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-query-devtools": "^5.101.2",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.3",
+    "oxlint": "^1.73.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
     "typescript": "~7.0.2",