feat: Claude Code Monitor — lanes, pipelines and a merged workspace

Internal SmartGift build of a Claude Code monitoring dashboard.

Lanes: a durable unit of parallel agent work, one per working directory,
tracked across session restarts. Managed lanes are git worktrees the
dashboard provisions and can reset or remove behind a three-check destroy
guard and a counted preflight; adopted lanes are directories you already
own and are never destroyable.

Pipelines: a lane moves through pipeline stages. A stage the agent declares
with evidence renders green; a stage inferred from the tool-event stream
renders dashed amber and never counts as done. Detection is forward-only
within a 30-minute window, and never writes the declared stage.

Workspace: one page at /run with a lane grid, the selected lane's pipeline,
and a full Claude console behind a disclosure.

deployments/terraform/modules/database/main.tf

@@ -0,0 +1,142 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Database module – Persistent storage for SQLite
+#
+# Creates a managed network file system (EFS on AWS) with:
+#   - Encryption at rest and in transit
+#   - Automated backup policy
+#   - Mount targets in each private subnet
+#   - Performance mode optimised for SQLite workloads
+# ─────────────────────────────────────────────────────────────────────────────
+
+locals {
+  name_prefix = lower(replace("${var.project_name}-${var.environment}", "_", "-"))
+
+  common_tags = merge(
+    {
+      module = "database"
+    },
+    var.tags,
+  )
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EFS file system
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_efs_file_system" "main" {
+  creation_token = "${local.name_prefix}-data"
+  encrypted      = true
+
+  # General Purpose is optimal for SQLite (latency-sensitive small I/O)
+  performance_mode = "generalPurpose"
+  throughput_mode  = "elastic"
+
+  lifecycle_policy {
+    transition_to_ia = "AFTER_30_DAYS"
+  }
+
+  lifecycle_policy {
+    transition_to_primary_storage_class = "AFTER_1_ACCESS"
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-efs"
+  })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EFS backup policy
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_efs_backup_policy" "main" {
+  file_system_id = aws_efs_file_system.main.id
+
+  backup_policy {
+    status = var.enable_backup ? "ENABLED" : "DISABLED"
+  }
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EFS mount targets (one per private subnet / AZ)
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_efs_mount_target" "main" {
+  count = length(var.private_subnet_ids)
+
+  file_system_id  = aws_efs_file_system.main.id
+  subnet_id       = var.private_subnet_ids[count.index]
+  security_groups = var.allowed_security_group_ids
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EFS access point – scoped to /app/data for the container workload
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_efs_access_point" "app_data" {
+  file_system_id = aws_efs_file_system.main.id
+
+  posix_user {
+    uid = 1000
+    gid = 1000
+  }
+
+  root_directory {
+    path = "/app-data"
+
+    creation_info {
+      owner_uid   = 1000
+      owner_gid   = 1000
+      permissions = "0755"
+    }
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-app-data-ap"
+  })
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EFS file system policy – enforce encryption in transit
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_efs_file_system_policy" "main" {
+  file_system_id = aws_efs_file_system.main.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "EnforceEncryptInTransit"
+        Effect    = "Deny"
+        Principal = { AWS = "*" }
+        Action    = "*"
+        Resource  = aws_efs_file_system.main.arn
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      },
+      {
+        Sid       = "AllowMountViaAccessPoint"
+        Effect    = "Allow"
+        Principal = { AWS = "*" }
+        Action = [
+          "elasticfilesystem:ClientMount",
+          "elasticfilesystem:ClientWrite",
+          "elasticfilesystem:ClientRootAccess",
+        ]
+        Resource = aws_efs_file_system.main.arn
+        Condition = {
+          Bool = {
+            "elasticfilesystem:AccessedViaMountTarget" = "true"
+          }
+        }
+      }
+    ]
+  })
+}

deployments/terraform/modules/database/outputs.tf

@@ -0,0 +1,38 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Database module outputs
+# ─────────────────────────────────────────────────────────────────────────────
+
+output "filesystem_id" {
+  description = "ID of the EFS file system"
+  value       = aws_efs_file_system.main.id
+}
+
+output "filesystem_arn" {
+  description = "ARN of the EFS file system"
+  value       = aws_efs_file_system.main.arn
+}
+
+output "filesystem_dns_name" {
+  description = "DNS name of the EFS file system"
+  value       = aws_efs_file_system.main.dns_name
+}
+
+output "mount_target_ids" {
+  description = "IDs of the EFS mount targets"
+  value       = aws_efs_mount_target.main[*].id
+}
+
+output "mount_target_ips" {
+  description = "IP addresses of the EFS mount targets"
+  value       = aws_efs_mount_target.main[*].ip_address
+}
+
+output "access_point_id" {
+  description = "ID of the EFS access point for /app/data"
+  value       = aws_efs_access_point.app_data.id
+}
+
+output "access_point_arn" {
+  description = "ARN of the EFS access point"
+  value       = aws_efs_access_point.app_data.arn
+}

deployments/terraform/modules/database/variables.tf

@@ -0,0 +1,60 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Database module variables
+# ─────────────────────────────────────────────────────────────────────────────
+
+variable "project_name" {
+  description = "Project identifier used in resource naming"
+  type        = string
+}
+
+variable "environment" {
+  description = "Deployment environment (dev, staging, production)"
+  type        = string
+}
+
+variable "cloud_provider" {
+  description = "Target cloud provider (aws, gcp, azure, oci)"
+  type        = string
+}
+
+variable "region" {
+  description = "Cloud region for deployment"
+  type        = string
+}
+
+variable "storage_size_gb" {
+  description = "Storage allocation in GiB (used by providers with provisioned capacity)"
+  type        = number
+  default     = 20
+  validation {
+    condition     = var.storage_size_gb >= 1
+    error_message = "storage_size_gb must be at least 1 GiB."
+  }
+}
+
+variable "enable_backup" {
+  description = "Enable automated backup of the file system"
+  type        = bool
+  default     = true
+}
+
+variable "private_subnet_ids" {
+  description = "Private subnet IDs for mount targets"
+  type        = list(string)
+}
+
+variable "vpc_id" {
+  description = "VPC ID for security group association"
+  type        = string
+}
+
+variable "allowed_security_group_ids" {
+  description = "Security group IDs allowed to mount the file system"
+  type        = list(string)
+}
+
+variable "tags" {
+  description = "Resource tags"
+  type        = map(string)
+  default     = {}
+}