evidence(440): production proofs for the hosted CLI and the v2.0.16 pin move

Merged
KH
2mo ago
+69-0

Evidence only — no code. Records every production proof for #440, the v2.0.16 release, the runtime artifact hash cross-check, the pin move (with the previous values for rollback), and two cloud-side observations.

🤖 Generated with Claude Code

[!NOTE]
Low Risk
Documentation and proof artifacts only; no runtime, CLI, or Cloud configuration changes in this diff.

Overview
Adds an evidence-only bundle under evidence/440-hosted-cli/ documenting production validation of the hosted CLI and the Cloud runtime pin move to v2.0.16 (fe8d7606).

The new README.md indexes proof runs (cloud flows run with sync, deploy/undeploy, issue-triggered listener, npm relayflows@2.0.16 sync round trip, and ./run.sh on the pinned runtime) with run IDs and outcomes. It also records the verified artifact sha256, pre-pin rollback values in pin-before.txt, S3 publish vs failed R2 publication, and two unfixed Cloud API observations (completionReason: null, no step stdout).

Supporting artifacts include YAML smoke flows (proof.flow.yaml, pin-proof.flow.yaml), CLI transcript files, and issue-echo.flow.ts showing the post–#444 shell-quoting fix for issue title text (contrasted with the pre-fix listener run).

Reviewed by Cursor Bugbot for commit 725d882d1c80b8e7876a5820fdfdd56d02ca1f8c. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by cubic

Adds production evidence for #440: the hosted CLI works against Cloud, the v2.0.16 runtime artifact is verified, and Cloud’s runtime pin has moved to v2.0.16. This is an evidence-only change, so no product code or runtime behavior is modified.

Evidence recorded

  • Documents flow runs covering sync, deploy/undeploy, and an issue-triggered listener run.
  • Cross-checks the v2.0.16 artifact sha256 against the filename and sidecar.
  • Saves the previous runtime pin values so the move can be rolled back.
  • Records that relayflows@2.0.16 syncs and runs successfully from npm.
  • Shell-quotes the smoke flow’s issue text to close an injection surface; the recorded run predates that fix.
  • Notes two Cloud-side observations: completed runs report a null completionReason, and step stdout is not exposed via the runs API.