Sync: dev to main

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
         run: pnpm turbo run build
 
       - name: Upload Hacklytics build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: hacklytics-out
           path: sites/hacklytics2027/out
@@ -69,7 +69,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           name: hacklytics-out
           path: sites/hacklytics2027/out
@@ -94,7 +94,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           name: hacklytics-out
           path: sites/hacklytics2027/out

.gitignore

@@ -19,6 +19,7 @@ build
 .DS_Store
 *.pem
 nul
+__pycache__/
 
 # Debug
 npm-debug.log*

docs/architecture.md

@@ -54,7 +54,9 @@ Edition-scoped event operations. Everything hangs off `hackathon`.
 
 - Editions, interest list, registration, teams, project submission
 - Weekend schedule (`hackathon_event`) and badge scans
-- Judging (`judge`, `judging_project`, `judge_vote`, `judge_queue`, `hackathon_result`)
+- Judge roster (`judge`, `judge_assignment`): applications and approval
+- Judging: room-based judging with Devpost import — `judging_*` tables (`judging.ts`). The older pool-dispatch tables (`judging_project`, `judge_vote`, `judge_queue`, `hackathon_result`) are retired and kept for past editions' results
+- Points: `hackathon_event` points, staff adjustments and the point store (`points.ts`)
 - Announcements and acceptance waves
 
 Hackathon participation is **open to non-members**. Membership is not a registration requirement.
@@ -68,7 +70,7 @@ Hackathon participation is **open to non-members**. Membership is not a registra
 3. Browser calls `/api/trpc/*` via `@trpc/react-query`. Superjson is the transformer.
 4. `createContext` loads the NextAuth session (when `db` exists), attaches `userId`, client IP, and the in-process cache.
 5. Procedures run through DB-required, sanitizer, content-type, rate-limit / DDoS, and (for mutations) cache invalidation middleware.
-6. Role gates (`isAdmin`, `isScanner`, `isJudge`, `isProjectLeader`, `isSuperAdmin`) live in `packages/api/src/middleware/procedures.ts`. There is no `adminProcedure` alias that skips a role check.
+6. Role gates (`isAdmin`, `isScanner`, `isProjectLeader`, `isSuperAdmin`) live in `packages/api/src/middleware/procedures.ts`. There is no `adminProcedure` alias that skips a role check.
 
 ## Auth
 

docs/contributing.md

@@ -18,7 +18,7 @@ Code owners: `.github/CODEOWNERS` assigns `*` to `@aamoghS`.
 1. Branch from `dev` unless you are fixing production.
 2. Keep club and hackathon concerns separate. Do not add `hackathon_id` to club tables.
 3. Put shared rules in the package that every caller can import. Membership grant/link logic belongs in `@query/db/services/membership`, not copied into auth, Stripe, and tRPC.
-4. Role checks go through `isAdmin` / `isScanner` / `isJudge` / `isProjectLeader` / `isSuperAdmin`. Do not invent an `adminProcedure` that is only `protectedProcedure`.
+4. Role checks go through `isAdmin` / `isScanner` / `isProjectLeader` / `isSuperAdmin`. Do not invent an `adminProcedure` that is only `protectedProcedure`.
 5. Dangerous HTML in tRPC input is **rejected**, not stripped. See [Security](./operations/security.md).
 6. Prices live in `packages/api/src/services/pricing.ts`. Do not hard-code dollar amounts in UI or Stripe calls.
 

docs/glossary.md

@@ -13,11 +13,11 @@
 | **Staff** | Active admin whose role is not `volunteer`. |
 | **Project leader** | `project_leader` row. Runs **club projects**. Not a staff role. |
 | **Club project** | `initiative` row. Members apply to join with a pitch and an optional resume. Never judged. Distinct from a hackathon **project**, which is a judged submission. The UI says "club project"; the table is still `initiative`. |
-| **Hackathon project** | Team/solo submission (`hackathon_project`). Promoted into `judging_project` for scoring. |
+| **Hackathon project** | Team/solo submission (`hackathon_project`). Promoted into a `judging_entry` for judging, alongside projects imported from Devpost. |
 | **Interest** | “Tell me when registration opens” (`hackathon_interest`). Requires a signed-in user. |
 | **Current edition** | In-progress hackathon if one exists; otherwise the newest edition that is not `draft` or `announced`. |
 | **Announced** | Public landing + interest, registration closed, **not** current for membership resolution. |
 | **Wave** | Batch accept of oldest pending applicants; acceptance email is stamped per participant so retries are safe. |
-| **Judging queue** | Per-judge ordered tables. `startedAt` is a short claim; `arrivedAt` is the QR scan at the table. |
+| **Judging room** | `judging_room`. Judges sit in a room that serves one challenge; projects present to it on the schedule. The QR code on its door seats a judge, or starts a guest judge's session. |
 | **Results snapshot** | `hackathon_result` — frozen placing. Live z-score is only used when computing that snapshot. |
 | **Bootcamp term** | String like `2026-fall`. Access checks this, not the never-expiring `bootcamp_member` boolean. |

docs/operations/environment.md

@@ -58,6 +58,13 @@ Without `DATABASE_URL`, `db` is null, sessions fall back to JWT, and tRPC proced
 | `RESUME_BUCKET` | Cloud Storage bucket holding resume PDFs (App Hosting sets `dsgt-resumes`). Unset means uploads return 503 rather than failing obscurely. Credentials are ADC — the runtime service account needs `roles/storage.objectAdmin`. See [Resume book](../resume-book.md) |
 | `BOOTCAMP_BUCKET` | Cloud Storage bucket holding bootcamp workshop ZIPs (App Hosting sets `dsgt-bootcamp`). Unset means uploads and downloads return 503. Same ADC and same `roles/storage.objectAdmin` as above. Downloads are proxied and gated on the caller's bootcamp term, so the bucket keeps public access prevention on |
 
+## Judging schedule
+
+| Variable | Default / notes |
+| --- | --- |
+| `JUDGING_CPSAT_PYTHON` | A Python with OR-Tools (`python3` or a path). Set, the schedule section can run `packages/api/scripts/judging-schedule/cpsat.py` on the server (`judging.schedule.solveCpsat`). Unset means CP-SAT is download, run on a laptop, upload |
+| `JUDGING_CPSAT_SCRIPT` | Path to `cpsat.py`. Default: found by walking up from the working directory |
+
 ## Security / proxy
 
 | Variable | Default / notes |

docs/operations/security.md

@@ -20,7 +20,6 @@ Roles are rows, not JWT claims.
 | `isScanner` | Any active `admin` including `volunteer` |
 | `isAdmin` | Active admin whose role is **not** `volunteer` |
 | `isSuperAdmin` | `super_admin` |
-| `isJudge` | Active `judge` for the resolved edition |
 | `isProjectLeader` | Active `project_leader` or staff |
 
 Volunteers can staff check-in desks. They cannot delete editions, grant memberships, or pass `isAdmin`.

docs/operations/testing.md

@@ -31,7 +31,7 @@ Config: `packages/api/vitest.config.ts`. Includes `src/**/*.test.ts` and `src/.i
 | Security / sanitizer / rate limit | `security.test.ts`, `resilience.test.ts` |
 | Judges / participants / initiatives / bootcamp / announcements | matching `*-edge.test.ts` / `bootcamp.test.ts` / `announcements.test.ts` |
 | Portal context | `services/portal-context.test.ts`, `routers/user/portal-context.test.ts` |
-| Judge helpers | `routers/judge/helpers.test.ts` |
+| Judging scoring, scope, room links | `services/judging/*.test.ts` |
 
 Tests use `src/test/create-mock-context.ts` and `.internal-tests/_db-tx-mock.ts` rather than a live database.
 

docs/packages/api.md

@@ -16,7 +16,9 @@ Exports: `.`, `./context`, `./trpc`, `./pricing`, plus a few middleware paths (s
 | `member` | `routers/member.ts` | Membership profile, pass, admin grant/revoke/search |
 | `hackathon` | `routers/hackathon/*` | Editions, registration, interest, events, content, announcements, staff ops |
 | `events` | `routers/events.ts` | Club events and QR check-in |
-| `judge` | `routers/judge/*` | Judge portal, rankings/results, admin judging |
+| `judge` | `routers/judge/*` | Judge roster: apply, approve, add, remove |
+| `judging` | `routers/judging/*` | Room judging: `admin`, `schedule`, `desk`, `hacker`, `results` |
+| `points` | `routers/points/*` | Hackathon points: `admin`, `store`, `me` |
 | `stripe` | `routers/stripe.ts` | Checkout, PaymentIntent, link, reconcile |
 | `audit` | `routers/audit.ts` | Audit log list (admin) |
 | `team` | `routers/team.ts` | Teams and project submission |
@@ -37,7 +39,6 @@ Defined in `src/trpc.ts` and `src/middleware/procedures.ts`.
 | `isScanner` | Active `admin` row | Volunteers included. Badge / door scanning only |
 | `isAdmin` | Active staff `admin` | Rejects `volunteer` |
 | `isSuperAdmin` | `role === "super_admin"` | Staff create/remove, judge activate/remove, set project leader |
-| `isJudge` | Active `judge` for the resolved hackathon | Resolves edition from input `hackathonId` / `projectId` / `queueId`, else current edition |
 | `isProjectLeader` | Active `project_leader` **or** staff | Staff can cover a quiet leader; leaders cannot use this to pass `isAdmin` |
 
 There is deliberately **no** `adminProcedure` that equals `protectedProcedure`. That name shipped open admin endpoints in the past.
@@ -86,11 +87,11 @@ Batch status updates allow up to **2500** ids. The global array cap in `scrubMar
 
 ## Judge procedures
 
-**Portal** (`portal.ts`): `isJudge`, assignments, applications, QR start, next table, vote, skip, overtime skip, progress. `toggleJudging` is admin.
+**Portal** (`portal.ts`): `isJudge` (for the named or current edition), `myApplications`, `register` (apply to judge).
 
-**Rankings** (`rankings.ts`): `getRankings`, `computeResults`, draft/publish/unpublish. Results are a **frozen snapshot** (`hackathon_result`), not a live z-score on every page load.
+**Admin** (`admin.ts`): `list`, `create` (add by email), `setActive` (approve or suspend), `remove` (super admin).
 
-**Admin** (`admin.ts`): CRUD judges, promote submissions into judging tables, initialize queues, assign tracks/projects, table cards, live progress, analytics. `setActive` and `remove` are super admin. `register` is protected (apply to judge).
+Judging itself is the `judging` namespace; its shared helpers are in `services/judging/` (`room-link`, `scope`, `scoring`, `config`). `hackathon.getResults` returns published placings from both the retired `hackathon_result` table and `judging_placement`, in one shape.
 
 ## Club procedures (selected)
 

docs/packages/db.md

@@ -28,7 +28,10 @@ Files in `src/schemas/`, re-exported from `schemas/index.ts`. `drizzle.config.ts
 | `members.ts` | `user_profile`, `member`, `membership_history` |
 | `admins.ts` | `admin` |
 | `hackathons.ts` | `hackathon`, `hackathon_team`, `hackathon_participant`, `hackathon_project`, `hackathon_interest`, `hackathon_event`, `hackathon_event_attendee`, `hackathon_announcement`, `hackathon_announcement_recipient` |
-| `judge.ts` | `judge`, `judge_assignment`, `judging_project`, `judge_vote`, `judge_queue`, `hackathon_result` |
+| `judge.ts` | `judge`, `judge_assignment` (live roster); `judging_project`, `judge_vote`, `judge_queue`, `hackathon_result` (retired, kept for past editions) |
+| `judging.ts` | `judging_*`: config, entries and members, challenges, buildings, rooms and room links, judges, guest sessions, presence, schedule and appointments, rubric, evaluations, deliberation, placements |
+| `points.ts` | `hackathon_point_adjustment`, `hackathon_store_item`, `hackathon_store_purchase` |
+| `retired.ts` | Enum types the retired panel judging service left in the database, declared so push does not try to drop them |
 | `initiatives.ts` | `project_leader`, `initiative`, `initiative_application` |
 | `events.ts` | `event`, `event_check_in` |
 | `bootcamp.ts` | `bootcamp_workshop` (metadata; the ZIPs are in Cloud Storage). `bootcamp_material` is legacy and unused |

docs/sites/hacklytics2027.md

@@ -32,16 +32,20 @@ Schedule copy lives in `components/sections/Schedule/data.ts`.
 
 ## Interest CTA
 
-`lib/links.ts` is the only outbound destination. The Typeform this replaced was pasted in four files and drifted.
+`lib/links.ts` is the only outbound destination. The Typeform URL was once pasted in four files and drifted.
 
-Interest requires a portal account (verified email). The CTA is:
+Every Notify me button and link (header, mobile menu, hero, FAQ, footer) points at `INTEREST_URL`, a Typeform, for now. On phones 356px and wider the header keeps a compact Notify me button beside the menu toggle, so the CTA does not hide inside the hamburger menu.
+
+Once registration opens on the portal, swap `INTEREST_URL` back to `PORTAL_INTEREST_URL`, which signs the visitor in first:
 
 ```
 {PORTAL_ORIGIN}/login?callbackUrl=/hacklytics
 ```
 
 `callbackUrl` is encoded so it survives the email-code hop through `/verify`. The portal only honors same-origin paths.
 
+The footer also links to the portal for the two audiences that are not waiting on the list: **Hacker portal** (`PORTAL_HACKATHON_URL`, `{PORTAL_ORIGIN}/hacklytics`) and **Judge Hacklytics** (`JUDGE_URL`, sign-in with `callbackUrl=/judge`).
+
 ## Deploy
 
 Firebase Hosting target `hacklytics`, public dir `sites/hacklytics2027/out` (`firebase.json`).

docs/sites/mainweb.md

@@ -38,17 +38,17 @@ Unauthenticated and authenticated product UI. `proxy.ts` marks these prefixes `p
 | `/club/bootcamp` | Bootcamp (paid add-on, term-gated) |
 | `/initiatives` | Browse / apply |
 | `/lead`, `/lead/[id]` | Project leader |
-| `/hackathons`, `/hackathons/[id]` | Edition pages (info, schedule, teams, projects, results) |
-| `/hackathons/[id]/judge` | Judging for that edition |
+| `/hackathons`, `/hackathons/[id]` | Edition pages (info, schedule, teams, projects, judging, points, results) |
 | `/hacklytics` | Current Hacklytics interest / portal landing |
 | `/submit` | Project submission |
 | `/judge`, `/judge/register` | Judge home / apply |
+| `/judge/[hackathonId]` | Judge desk for one edition |
 | `/scan` | QR scanning |
 | `/admin` | Staff home |
-| `/admin/hackathons`, `/admin/hackathons/[id]` | Edition admin (attendees, waves, announcements, analytics, events). `[id]` is the name slug (`hacklytics-digital-bloom`), not a percent-encoded name. |
+| `/admin/hackathons`, `/admin/hackathons/[id]` | Edition admin (attendees, waves, announcements, analytics, events, judges, points, store). `[id]` is the name slug (`hacklytics-digital-bloom`), not a percent-encoded name. |
 | `/admin/members` | Membership admin |
 | `/admin/attendees` | Attendee tools |
-| `/admin/judging` | Judging admin (sync submissions + assign judges live here) |
+| `/admin/judging`, `/admin/judging/[hackathonId]` | Pick an edition, then run its judging: import, rooms, schedule, results |
 | `/admin/initiatives` | Initiative / proposal review |
 | `/admin/bootcamp` | Bootcamp attendance grid and the weekly workshop table |
 | `/admin/staff` | Admin users |

monitoring/README.md

@@ -42,6 +42,12 @@ number of instances is irrelevant:
 - `dsgt_members_active`, `dsgt_members_lapsed`
 - `dsgt_bootcamp_enrolled{term}`
 - `dsgt_payments_by_plan{plan}` — the yearly/semester split
+- `dsgt_hackathon_participants{edition,phase,status}`, `dsgt_hackathon_projects`,
+  `dsgt_hackathon_checkins_today`, `dsgt_hackathon_judging_projects`,
+  `dsgt_hackathon_votes`, `dsgt_hackathon_judging_active` — only editions that
+  are `open`, `closed`, or `in_progress`. A completed edition disappears on
+  the next refresh. Badge scans are hackathon QR rows since midnight Eastern,
+  not club door check-ins.
 - `dsgt_payments_unlinked` — paid, claimed by nobody. This is **not** zero and
   is not supposed to be: as of August 2026 it sits around 428 of 443 paid rows,
   nearly all from the August–September 2025 and January 2026 drives. Those are
@@ -85,6 +91,8 @@ The alerts that matter:
 - `MembershipGrantFailing` — a payment was recorded and the membership was not.
 - `UnlinkedPaymentsClimbing` — the link paths are not claiming payments.
 - `ReconcileRecoveringOften` — the backstop is carrying the fast path.
+- `HackathonJudgingIdle` — judging is on, tables are assigned, and no scores
+  have landed for 30 minutes.
 
 To route them into ClickUp, run Alertmanager with a webhook receiver and pipe
 its payload to `node scripts/clickup-task.mjs --stdin`. That step is not built

monitoring/clickhouse/init/02-hackathon.sql

@@ -0,0 +1,57 @@
+-- Hackathon history. Same reason as the payment tables: aggregate it here,
+-- not on the 0.5 GB application database. `export:clickhouse` creates these
+-- too, so a volume that already ran 01-schema.sql still picks them up.
+
+CREATE DATABASE IF NOT EXISTS dsgt;
+
+CREATE TABLE IF NOT EXISTS dsgt.hackathon_registrations
+(
+    id            String,
+    hackathon     String,
+    status        LowCardinality(String),
+    registered_at DateTime64(3),
+    updated_at    DateTime64(3)
+)
+ENGINE = ReplacingMergeTree(updated_at)
+ORDER BY (hackathon, id);
+
+CREATE TABLE IF NOT EXISTS dsgt.hackathon_projects
+(
+    id           String,
+    hackathon    String,
+    status       LowCardinality(String),
+    submitted_at Nullable(DateTime64(3)),
+    updated_at   DateTime64(3)
+)
+ENGINE = ReplacingMergeTree(updated_at)
+ORDER BY (hackathon, id);
+
+CREATE TABLE IF NOT EXISTS dsgt.hackathon_scans
+(
+    id            String,
+    hackathon     String,
+    event_name    String,
+    checked_in_at DateTime64(3)
+)
+ENGINE = ReplacingMergeTree(checked_in_at)
+ORDER BY (hackathon, id);
+
+CREATE TABLE IF NOT EXISTS dsgt.hackathon_votes
+(
+    id         String,
+    hackathon  String,
+    score      Int32,
+    voted_at   DateTime64(3),
+    updated_at DateTime64(3)
+)
+ENGINE = ReplacingMergeTree(updated_at)
+ORDER BY (hackathon, id);
+
+CREATE VIEW IF NOT EXISTS dsgt.hackathon_registrations_by_status AS
+SELECT
+    hackathon,
+    status,
+    count() AS registrations
+FROM dsgt.hackathon_registrations FINAL
+GROUP BY hackathon, status
+ORDER BY hackathon, status;