Add WHOOSH search service with BACKBEAT integration

Complete implementation:
- Go-based search service with PostgreSQL and Redis backend
- BACKBEAT SDK integration for beat-aware search operations
- Docker containerization with multi-stage builds
- Comprehensive API endpoints for project analysis and search
- Database migrations and schema management
- GITEA integration for repository management
- Team composition analysis and recommendations

Key features:
- Beat-synchronized search operations with timing coordination
- Phase-based operation tracking (started → querying → ranking → completed)
- Docker Swarm deployment configuration
- Health checks and monitoring
- Secure configuration with environment variables

Architecture:
- Microservice design with clean API boundaries
- Background processing for long-running analysis
- Modular internal structure with proper separation of concerns
- Integration with CHORUS ecosystem via BACKBEAT timing

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

docs/API_SPECIFICATION.md

@@ -1,6 +1,13 @@
 # WHOOSH API Specification
 ## Autonomous AI Development Teams API
 
+Auth & Scope Revision (MVP)
+- Humans: authenticate via Gitea OIDC; WHOOSH should not issue long-lived user JWTs. Maintain short-lived sessions or signed service tokens as needed.
+- Agents/services: use scoped service tokens (PAT-like), revocable, with minimal permissions.
+- MVP endpoints: focus on tasks intake (from Gitea), team state, PR linkage/status, and a proxy for SLURP submissions. WebSocket streams are read-only status.
+- Envelopes: include `version`, `schema_version`, and `request_id`. Enforce JSON Schema validation and size limits. References only (UCXL/CIDs), no large artefacts.
+- Rate limiting: per token and IP, with 429 + Retry-After. Idempotency keys for mutating endpoints.
+
 ### Overview
 
 This document defines the comprehensive API specification for WHOOSH's transformation into an Autonomous AI Development Teams orchestration platform. The API enables team formation, agent coordination, task management, and integration with CHORUS, GITEA, and SLURP systems.
@@ -18,28 +25,14 @@ WebSocket Endpoint: wss://whoosh.chorus.services/ws
 
 ## 🔐 Authentication
 
-### JWT Token Structure
-```json
-{
-  "sub": "user_id_or_agent_id",
-  "type": "user" | "agent" | "system",
-  "iat": 1625097600,
-  "exp": 1625184000,
-  "roles": ["admin", "team_lead", "agent", "viewer"],
-  "permissions": [
-    "teams.create",
-    "agents.manage",
-    "tasks.assign"
-  ],
-  "capabilities": ["security", "backend", "frontend"], // For agents
-  "agent_metadata": { // For agent tokens
-    "node_id": "12D3KooW...",
-    "hardware": {...},
-    "models": [...],
-    "specialization": "security_expert"
-  }
-}
-```
+Note: Prefer OIDC for humans; if JWTs are used, scope narrowly and keep short expiry. Agents should use service tokens bound to explicit scopes.
+
+### MVP Endpoints (v1)
+- POST `/api/v1/tasks/ingest` (internal, from webhook) – accept `bzzz-task` issue payloads
+- GET `/api/v1/teams/:id` – team state summary
+- GET `/api/v1/teams/:id/activity` (WS) – read-only status stream
+- POST `/api/v1/teams/:id/submissions` – forward to SLURP with UCXL address
+- GET `/api/v1/status` – health/status
 
 ### Authentication Endpoints
 
@@ -1174,4 +1167,4 @@ ws.send(JSON.stringify({
 }
 ```
 
-This API specification provides the complete interface for WHOOSH's transformation into an Autonomous AI Development Teams platform, enabling sophisticated team orchestration, agent coordination, and collaborative development processes across the CHORUS ecosystem.
+This API specification provides the complete interface for WHOOSH's transformation into an Autonomous AI Development Teams platform, enabling sophisticated team orchestration, agent coordination, and collaborative development processes across the CHORUS ecosystem.

docs/CHORUS_INTEGRATION_SPEC.md

@@ -1,6 +1,13 @@
 # WHOOSH-CHORUS Integration Specification
 ## Autonomous Agent Self-Organization and P2P Collaboration
 
+Addendum (Terminology, Topics, MVP)
+- Terminology: all former “BZZZ” references are CHORUS; CHORUS runs dockerized (no systemd assumptions).
+- Topic naming: team channel root is `whoosh.team.<first16_of_sha256(normalize(@project:task))>` with optional `.control`, `.voting`, `.artefacts` (references only). Include UCXL address metadata.
+- Discovery: prefer webhook-driven discovery from WHOOSH (Gitea issues events), with polling fallback. Debounce duplicate applications across agents.
+- MVP toggle: single-agent executor mode (no team self-application) for `bzzz-task` issues is the default until channels stabilize; team application/commenting is feature-flagged.
+- Security: sign all control messages; maintain revocation lists in SLURP; reject unsigned/stale. Apply SHHH redaction before persistence and fan-out.
+
 ### Overview
 
 This document specifies the comprehensive integration between WHOOSH's Team Composer and the CHORUS agent network, enabling autonomous AI agents to discover team opportunities, self-assess their capabilities, apply to teams, and collaborate through P2P channels with structured reasoning (HMMM) and democratic consensus mechanisms.
@@ -1255,4 +1262,4 @@ func (cim *CHORUSIntegrationMetrics) GenerateIntegrationReport() *IntegrationHea
 }
 ```
 
-This comprehensive CHORUS integration specification enables autonomous AI agents to seamlessly discover team opportunities, apply intelligently, collaborate through P2P channels with structured reasoning, and deliver high-quality artifacts through democratic consensus processes within the WHOOSH ecosystem.
+This comprehensive CHORUS integration specification enables autonomous AI agents to seamlessly discover team opportunities, apply intelligently, collaborate through P2P channels with structured reasoning, and deliver high-quality artifacts through democratic consensus processes within the WHOOSH ecosystem.

docs/DATABASE_SCHEMA.md

@@ -1,6 +1,11 @@
 # WHOOSH Database Schema Design
 ## Autonomous AI Development Teams Data Architecture
 
+MVP Schema Subset (Go migrations)
+- Start with: `teams`, `team_roles`, `team_assignments`, `agents` (minimal fields), `slurp_submissions` (slim), and `communication_channels` (metadata only).
+- Postpone: reasoning_chains, votes, performance metrics, analytics/materialized views, and most ENUM-heavy objects. Prefer text + check constraints initially where flexibility is beneficial.
+- Migrations: manage with Go migration tooling (e.g., golang-migrate). Forward-only by default; keep small, reversible steps.
+
 ### Overview
 
 This document defines the comprehensive database schema for WHOOSH's transformation into an Autonomous AI Development Teams orchestration platform. The schema supports team formation, agent management, task analysis, consensus tracking, and integration with CHORUS, GITEA, and SLURP systems.
@@ -1232,4 +1237,4 @@ GROUP BY DATE(t.created_at)
 ORDER BY formation_date DESC;
 ```
 
-This comprehensive database schema provides the foundation for WHOOSH's transformation into an Autonomous AI Development Teams platform, supporting sophisticated team orchestration, agent coordination, and collaborative development processes while maintaining performance, security, and scalability.
+This comprehensive database schema provides the foundation for WHOOSH's transformation into an Autonomous AI Development Teams platform, supporting sophisticated team orchestration, agent coordination, and collaborative development processes while maintaining performance, security, and scalability.

docs/DEVELOPMENT_PLAN.md

@@ -1,6 +1,13 @@
 # WHOOSH Transformation Development Plan
 ## Autonomous AI Development Teams Architecture
 
+Sanity Addendum (Go + MVP-first)
+- Backend in Go for consistency with CHORUS; HTTP/WS with chi/echo, JSON Schema validation, structured logs. Optional Team Composer as a separate Go service calling local Ollama endpoints (cloud models opt-in only).
+- Orchestration: Docker Swarm with nginx ingress; secrets via Swarm; SHHH scrubbing at API/WS ingress and before logging.
+- MVP-first scope: single-agent path acting on `bzzz-task` issues → PRs; WHOOSH provides minimal API + status views. Defer HMMM channels/consensus and full Composer until post-MVP.
+- Database: start with a minimal subset (teams, team_roles, team_assignments, agents-min, slurp_submissions-min). Defer broad ENUMs/materialized views and analytics until stable.
+- Determinism & safety: Validate all LLM outputs (when enabled) against versioned JSON Schemas; cache analyses with TTL; rate limit; apply path allowlists and diff caps; redact secrets.
+
 ### Overview
 
 This document outlines the comprehensive development plan for transforming WHOOSH from a simple project template tool into a sophisticated **Autonomous AI Development Teams Architecture** that orchestrates CHORUS agents into self-organizing development teams.
@@ -275,4 +282,4 @@ This document outlines the comprehensive development plan for transforming WHOOS
 - [ ] Advanced workflow automation
 - [ ] Cross-organization team collaboration
 
-This development plan provides the foundation for transforming WHOOSH into the central orchestration platform for autonomous AI development teams, ensuring scalable, secure, and effective collaboration between AI agents in the CHORUS ecosystem.
+This development plan provides the foundation for transforming WHOOSH into the central orchestration platform for autonomous AI development teams, ensuring scalable, secure, and effective collaboration between AI agents in the CHORUS ecosystem.

docs/GITEA_INTEGRATION.md

@@ -83,32 +83,33 @@ GiteaService._setup_bzzz_labels()
 GITEA API: Create Labels
     ↓
 Project Ready for BZZZ Coordination
+Project Ready for CHORUS Coordination
 ```
 
-### BZZZ → GITEA Task Coordination
+### CHORUS → GITEA Task Coordination
 
 ```
-BZZZ Agent Discovery
+CHORUS Agent Discovery
     ↓
 GiteaService.get_bzzz_tasks()
     ↓
 GITEA API: List Issues with 'bzzz-task' label
     ↓
-BZZZ Agent Claims Task
+CHORUS Agent Claims Task
     ↓
 GITEA API: Assign Issue + Add Comment
     ↓
-BZZZ Agent Completes Task
+CHORUS Agent Completes Task
     ↓
 GITEA API: Close Issue + Results Comment
 ```
 
-## 🏷️ **BZZZ Label System**
+## 🏷️ **CHORUS Task Label System**
 
-The following labels are automatically created for BZZZ task coordination:
+The following labels are used for CHORUS task coordination (primary label name remains `bzzz-task` for compatibility):
 
-### Core BZZZ Labels
-- **`bzzz-task`** - Task available for BZZZ agent coordination
+### Core Labels
+- **`bzzz-task`** - Task available for CHORUS agent coordination
 - **`in-progress`** - Task currently being worked on  
 - **`completed`** - Task completed by BZZZ agent
 
@@ -161,7 +162,7 @@ When creating a new project, WHOOSH automatically:
    - Sets up repository with README, .gitignore, LICENSE
    - Configures default branch and visibility
 
-2. **Installs BZZZ Labels**
+2. **Installs CHORUS Labels**
    - Adds all task coordination labels
    - Sets up proper color coding and descriptions
 
@@ -171,16 +172,16 @@ When creating a new project, WHOOSH automatically:
 
 4. **Configures Integration**
    - Links project to repository in WHOOSH database
-   - Enables BZZZ agent discovery
+   - Enables CHORUS agent discovery
 
-## 🤖 **BZZZ Agent Integration**
+## 🤖 **CHORUS Agent Integration**
 
 ### Task Discovery
 
-BZZZ agents discover tasks by:
+CHORUS agents discover tasks by:
 
 ```go
-// In BZZZ agent
+// In CHORUS agent
 config := &gitea.Config{
     BaseURL:     "http://ironwood:3000",
     AccessToken: os.Getenv("GITEA_TOKEN"),
@@ -318,4 +319,4 @@ For issues with GITEA integration:
 
 **GITEA Integration Status**: ✅ **Production Ready**  
 **BZZZ Coordination**: ✅ **Active**  
-**Agent Discovery**: ✅ **Functional**
+**Agent Discovery**: ✅ **Functional**

docs/TEAM_COMPOSER_SPEC.md

@@ -1,6 +1,12 @@
 # WHOOSH Team Composer Specification
 ## LLM-Powered Autonomous Team Formation Engine
 
+MVP Scope and Constraints
+- Composer is optional in MVP: provide stubbed compositions (minimal_viable, balanced_standard). Full LLM analysis is post-MVP.
+- Local-first models via Ollama; cloud providers are opt-in and must be explicitly enabled. Enforce strict JSON Schema validation on all model outputs; cache by normalized task hash with TTL.
+- Limit outputs for determinism: cap team size and roles, remove chemistry analysis in v1, and require reproducible prompts with seeds where supported.
+- Security: redact sensitive data (SHHH) on all ingress/egress; do not log tokens or raw artefacts; references only (UCXL/CIDs).
+
 ### Overview
 
 The Team Composer is the central intelligence of WHOOSH's Autonomous AI Development Teams architecture. It uses Large Language Models to analyze incoming tasks, determine optimal team compositions, and orchestrate the formation of self-organizing AI development teams through sophisticated reasoning and pattern matching.
@@ -1076,4 +1082,4 @@ class ComposerFeedbackLoop:
         await self._update_composition_rules(insights)
 ```
 
-This Team Composer specification provides the foundation for WHOOSH's intelligent team formation capabilities, enabling sophisticated analysis of development tasks and automatic composition of optimal AI development teams through advanced LLM reasoning and pattern matching.
+This Team Composer specification provides the foundation for WHOOSH's intelligent team formation capabilities, enabling sophisticated analysis of development tasks and automatic composition of optimal AI development teams through advanced LLM reasoning and pattern matching.