Add Cloud operational acceptance checks and native platform smoke

Merged
BI
1mo ago
+2920-1

Summary

Cloud setup previously lacked repeatable evidence distinguishing repository source, installed artifacts and instructions actually loaded by a native session. Add operational acceptance tooling for the six approved recommendations:

  • Collect bounded source/optional installed-artifact provenance and provide private checkout-owned subprocess homes, preserving legacy migration and local modifications.
  • Check explicit static Cloud contracts across seven repository adapters without executing foreign code; automate this checkout's contract check and allow explicit anonymous inspection of other public main branches.
  • Diagnose inherited worker heap and available host/cgroup resources with explicit headroom; unknown resource boundaries fail readiness.
  • Exercise the real bootstrap on native Windows and in isolated Linux fixtures, including spaces/apostrophes, donor copy, hooks and mismatch rejection; test synthetic HTTP identity/forwarding separately from real-host acceptance.
  • Document native context/forwarding acceptance and continue the existing canonical task identity.

Coverage runners may ship a different npm from the bootstrap's exact declared version. Stage the declared npm only in the coverage job's temporary directory and pass its home only to the acceptance fixtures; the real bootstrap's version check remains enforced. Add explicit cache opt-outs to the standalone workflows, bounded fixture cleanup retries and the generated guide-awareness snapshot.

Final review corrections distinguish a real cgroupv2 root without memory.max from unreadable finite/hidden boundaries, reject malformed mount paths with bounded traversal, preserve Windows environment-name casing for anonymous fetches, isolate Git fixtures from host configuration and symlinked temporary roots, and reject trailing-dot localhost as a remote HTTPS preview. Each validated defect has failing-before/passing-after regression evidence; independent delta review approved.

Areas touched: Knowledge and records; Delivery and assurance.

Verification

  • Targeted implementation, neighboring contracts and CI safety checks: 262 tests across 10 suites passed.
  • Exact origin/main static source audit: 7/7 repositories passed, with revisions recorded; no foreign code executed.
  • Typecheck, focused ESLint, whole-tree format, Actions pins, CI scope/planner, generated snapshot and diff checks passed. Normal commit/push safeguards retained.
  • Independent complete-scope review and bounded follow-up reviews. The resource false-ready finding and npm-home selection have failing-before/passing-after regressions.
  • Real pinned npm11.17 succeeds with ambient npm11.9; unavailable homes and wrong versions fail without relaxing runtime checks.
  • Final commit 9dbce2bb8 passed all selected required CI: 32,193 unit tests and 762 production browser tests passed, with one existing skip in each group; both coverage partitions/aggregate, build, static, native Windows, Cloud contracts, SAST and secret scanning succeeded. MainCI39045293200 / PR-required117436124822; observed2026-10-17T15:50:51Z.
  • Instruction budgets/retirement/rule consistency, organisation mapping and maintained documentation checks passed. Existing unrelated chunking-test placement warning remains advisory.

Observed final-head CI: static/policy checks, both unit coverage partitions, Cloud source contracts, native Windows bootstrap and security checks. Actual final CI also selected an application build and production UI critical/three browser shards. All selected checks passed on final 9dbce2bb8. The earlier local scope prediction was superseded by observed CI selection.

Still unverified: fresh native-client loaded context and actual host-forwarded browser acceptance. This host exposes neither supported control; source and synthetic fixture success do not establish these layers.

Risk and rollout

No application, clinical, retrieval, database, dependency manifest/lockfile or production deployment behavior changes. Existing CI receives only temporary coverage-job npm staging; gates/timeouts remain enforced. Diagnostic/scoping commands are opt-in.

Rollback: revert the source change. No host profiles, credentials, environment policy or production services were provisioned. This task does not merge or change auto-merge; the externally enabled setting is preserved.

Maintained entry point: docs/agents/cloud-instruction-activation.md. Canonical task identity remains BigSimmo/PsychSift:cloud-cross-repo-hardening-2026-10-17; local receipts are evidence exports.

Summary by cubic

Adds repeatable operational acceptance checks for cloud source updates: static cross-repository contract inspection, build-memory diagnostics, activation evidence collection, an isolated home wrapper, and a native Windows bootstrap smoke run. Recent fixes make the diagnostics fail closed and tolerate real-world host quirks rather than assuming an ideal environment.

  • Validates static Cloud contracts across seven repositories without executing foreign source; current-repo checks run automatically on relevant changes.
  • Reports effective worker heap and host/cgroup capacity; unknown membership, controller-less cgroup mounts, and ambiguous heap probes are now handled explicitly instead of passing silently.
  • Collects checkout and optional installed-artifact provenance without credentials or active-session claims.
  • Runs a narrow native windows-2025 bootstrap job with synthetic HTTP fixtures; it now tolerates already-exited proxy children and recognizes installer marker prefixes, and CI fixtures are deterministic. No browser install or deployment is executed.
  • Rejects Playwright preview URLs whose hostname ends in a terminal DNS dot, preventing local-origin bypass.

CodeAnt-AI Description

Add bounded checks for Cloud source, build capacity, and platform setup

What Changed

  • Collect source revisions and file hashes, and optionally compare recognized installed artifacts with their source. Mismatches are reported without reading credentials or claiming that a native session loaded the instructions.
  • Check inherited Node heap and available host or container memory before production builds; unclear or insufficient capacity fails the check.
  • Check Cloud source contracts across seven repositories without running their code. Relevant changes trigger local CI checks; inspecting other public main branches is an explicit option.
  • Add an isolated-home wrapper for explicitly launched commands, plus Windows bootstrap and synthetic HTTP identity acceptance checks.

Impact

✅ Detects build-memory shortages before production runs
✅ Catches Cloud instruction and installed-file mismatches
✅ Checks Windows bootstrap without changing global tools

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

  • New Features
    • Added tools to check cloud-build memory capacity, verify Cloud platform bootstrap behavior, audit cloud contracts across repositories, and collect local activation evidence.
    • Added an option to run commands with isolated Cloud configuration directories.
    • Added automated workflows for Cloud contract checks and Windows platform smoke checks.
  • Documentation
    • Added guidance on build resource checks, Cloud instruction activation, platform acceptance, isolated legacy setup, and cross-repository contracts.