updates on the ai and agent and all thse things awith onboarding

main.go

@@ -12,6 +12,8 @@ import (
 	"doormile/config"
 	"doormile/controllers"
 	"doormile/db"
+	"doormile/internal/ai/playground"
+	"doormile/internal/ai/telemetry"
 	"doormile/internal/assignment"
 	"doormile/internal/notify"
 	"doormile/internal/routing"
@@ -85,6 +87,14 @@ func main() {
 	_ = godotenv.Load()
 	cfg := config.Load()
 
+	// Refuse to boot production on a committed fallback secret. Checked before
+	// anything connects, so a misconfigured deploy fails loudly at start rather
+	// than serving traffic with a JWT secret that is in the git history.
+	if missing := cfg.MissingProductionSecrets(); len(missing) > 0 {
+		utils.Error("Refusing to start: required secrets are not set in production", "missing", strings.Join(missing, ","))
+		os.Exit(1)
+	}
+
 	utils.Info("Starting Doormile Backend...")
 
 	// 2. Connect to Postgres, Redis & NATS
@@ -220,6 +230,20 @@ func main() {
 	// 9. Point the stop sequencer at the Route Optimization API.
 	routing.BaseURL = cfg.RouteOptimizerURL
 
+	// 10. Record AI_engine agent runs (telemetry.task) and live state
+	// (telemetry.agent). Observability only: a nil NATS connection logs and
+	// skips, and nothing here can block a request.
+	if db.DB != nil {
+		telemetry.NewRecorder(db.DB, db.Rdb).Start(db.Nc)
+	}
+
+	// Agent Studio Test playground: switched on only when a model API key is
+	// configured. Without one the endpoint answers 503 and the console says so.
+	if cfg.PlaygroundLLMAPIKey != "" {
+		controllers.PlaygroundModel = playground.NewOpenAICompat(cfg.PlaygroundLLMBaseURL, cfg.PlaygroundLLMAPIKey, cfg.PlaygroundLLMModel)
+		utils.Info("ai playground: enabled", "base_url", cfg.PlaygroundLLMBaseURL, "model", cfg.PlaygroundLLMModel)
+	}
+
 	// 7. Startup server in a background thread
 	go func() {
 		utils.Info("Server starting", "port", cfg.Port)