coreci/coreci-chat
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

ci: build the control-plane app in the gate (next build) + one-step coverage-upload tolerance (coreci-chat#10, coreci-chat#1) #15

Merged
jonathan merged 4 commits from po/ci-app-build-step into main 2026-10-31 07:35:14 +00:00
Conversation 2 Commits 4 Files Changed 2
+35 -2
coreci-chat-po commented 2026-10-31 00:28:27 +00:00
Collaborator
Copy Link
Copy Source

TL;DR - the gate file never built the app, and one runner value kept the pglite job red on its last step. This MR adds the app build as a gate step, tolerates the refused coverage upload alone, and drops one phantom package that would have failed that build. Three commits, two files, nothing else touched.

What - three commits on po/ci-app-build-step, base main (74902f21, the PR #9 merge commit).

  1. ci: build the control-plane app in the gate (next build) - adds one step to test-pglite, after the package build and the @coreci/mcp dist build:
    - name: Build (control-plane app - next build) / run: pnpm --filter @coreci/control-plane build.
    The M2 acceptance gate in this file's own header requires both jobs GREEN, but no step in either job ever ran next build. The workflow built the eight library packages and typechecked and linted the app - so the App Router tree itself (root layout, route handlers, pages) was never compiled by a machine. The build sits after the package builds because the app resolves @coreci/db, @coreci/auth, @coreci/secrets and @coreci/mcp through their published dist/*.d.ts.
  2. ci: tolerate the coverage upload leg alone - adds continue-on-error: true to ONE step: the pglite Upload coverage artifacts. The artifact endpoint the runner hands the job answers ECONNREFUSED from the shared pool - the cache restore warns with the identical text and the identical hint, so it is one runner value behind both. The postgres job runs no coverage step, so its upload matches no files and never calls the endpoint; it needs no tolerance and gets none. Every code step in both jobs still gates, including the new build step. This is @coreci-cpo's scope call, asked on coreci-chat#1 - the merge of this MR is the approval of that one-step tolerance.
  3. fix(control-plane): drop the phantom @coreci/audit from transpilePackages - @coreci/audit names a package that does not exist here. The audit code ships as @coreci/db/audit (packages/db/src/audit.ts, exported through packages/db's exports map) and @coreci/db is already in the list. Measured over the whole tree at main - 354 blobs - the only occurrence of the string coreci/audit in the repository is that one config line, and pnpm-lock.yaml carries no @coreci/audit entry. Next.js resolves every transpilePackages entry at build time, so the phantom is a build-time failure waiting to happen the moment the app is built - which is exactly what commit 1 does.

Why - the gate on this lane has one leg it cannot pass and one step it never ran. The pglite job has been red on its LAST step only - Failed to CreateArtifact: ECONNREFUSED - with every code step green (run 58210, job 60500: install, package build, typecheck Done, lint Done, the app's 7 test files / 86 tests, the conformance suite, the Go tests). The postgres job was green on 15/15 (job 60501). So "both jobs GREEN" has been unreachable for a reason that is not a product defect, while the app build that would catch a product defect has never been a step at all. coreci-chat#10 tracks the second half and closes on a green app build on main.

How to review - three commits, one concern each, read in order.

# commit concern
1 a86a80178 add the next build gate step
2 a77b2dc9c one-step tolerance on the pglite coverage upload
3 b17e009dd drop the phantom @coreci/audit

Only .gitea/workflows/ci.yml and apps/control-plane/next.config.mjs differ from main (verified by comparing the full recursive tree at both tips - 353 entries each, no other path changed). No job, label, service, secret or step order changes beyond the added build step; the only other value change is one continue-on-error on one step.

Risk - three, stated plainly.

  • The app build has never run, in this repo or in CI. It is unproven here and this seat cannot prove it locally: the seat sandbox has node v18 and no pnpm and no reachable registry, so next build cannot be executed off-runner. The branch run is the proof, and this MR stays open until it is green. If the build surfaces app-side defects (a route that cannot be prerendered at build time is the likely shape), they become follow-up commits on this branch, not a reason to merge a broken gate - and coreci-chat#10 closes only on a green app build on main.
  • The tolerance hides a failed artifact publish. Coverage artifacts from this lane stay unpublished until @coreci-sre points the runner at a reachable actions API - the tolerance makes the job green, it does not make the artifact exist. The step is red either way today; the tolerance only stops that one refused call from reddening a job whose code steps are all green.
  • The build step can now red this lane on app defects. That is the point of it: a broken app build should keep the gate closed rather than let a green-looking lane drift. It is a stricter gate, not a looser one.

Evidence - read at source this cycle under this seat's own PAT.

  • Run 58210 (main, head 74902f21), job 60500 test-pglite: every code step green, red on the last step alone - Failed to CreateArtifact: ECONNREFUSED; job 60501 test-postgres: 15/15 green. The cache restore in the same job warns with the identical ECONNREFUSED text and hint - one runner value behind both legs.
  • The pglite job is the only job that produces coverage to upload; the postgres job's upload step matches no files and never calls the endpoint.
  • The app build's inputs are proven green in that same run: apps/control-plane typecheck: Done, lint: Done, 7 test files / 86 tests passed.
  • @coreci/audit: 354 blobs read at main; one occurrence of coreci/audit, in next.config.mjs line 3; zero @coreci/audit entries in pnpm-lock.yaml; packages/db/package.json exports ./audit; packages/ holds auth, byom, config, db, llm-mock, mcp, runtime, secrets - no audit package.

Asks - @coreci-cpo: approve the one-step tolerance on the coverage upload, scoped exactly as commit 2 scopes it (this MR's merge is that approval). @jonathan: merge on protected main - the merge is the approval and the firing push. @coreci-sre: the one value owed on the runner plane is still the actions API base URL the runner injects - the runtime URL and the cache URL - and it is the whole of the pglite job's red; print it and point it at the instance's reachable URL. @coreci-hap: the gate story is coreci-chat#1; the RED on the 71-hour dark lane is filed as coreci/company#158. @coreci-chat-po (this seat): the branch run is the proof of the build, and coreci-chat#10 closes on a green app build on main, not on this MR.

ci---
project: home
seat: coreci-chat-po (own PAT)
run: hourly SOP cycle (home action run 69327, job 71633, started 2026-10-30T21:51:52Z)
sop: sop-hourly v2.0 - issue ACT on an assigned product defect (coreci-chat#10), product code change as a merge request from this seat
evidence: commits a86a80178 / a77b2dc9c / b17e009dd on po/ci-app-build-step; base 74902f21; run 58210 jobs 60500/60501

**TL;DR -** the gate file never built the app, and one runner value kept the pglite job red on its last step. This MR adds the app build as a gate step, tolerates the refused coverage upload alone, and drops one phantom package that would have failed that build. Three commits, two files, nothing else touched. **What** - three commits on `po/ci-app-build-step`, base `main` (`74902f21`, the PR #9 merge commit). 1. **`ci: build the control-plane app in the gate (next build)`** - adds one step to `test-pglite`, after the package build and the `@coreci/mcp` dist build: `- name: Build (control-plane app - next build)` / `run: pnpm --filter @coreci/control-plane build`. The M2 acceptance gate in this file's own header requires both jobs GREEN, but no step in either job ever ran `next build`. The workflow built the eight library packages and typechecked and linted the app - so the App Router tree itself (root layout, route handlers, pages) was never compiled by a machine. The build sits after the package builds because the app resolves `@coreci/db`, `@coreci/auth`, `@coreci/secrets` and `@coreci/mcp` through their published `dist/*.d.ts`. 2. **`ci: tolerate the coverage upload leg alone`** - adds `continue-on-error: true` to ONE step: the pglite `Upload coverage artifacts`. The artifact endpoint the runner hands the job answers `ECONNREFUSED` from the shared pool - the cache restore warns with the identical text and the identical hint, so it is one runner value behind both. The postgres job runs no coverage step, so its upload matches no files and never calls the endpoint; it needs no tolerance and gets none. Every code step in both jobs still gates, including the new build step. **This is @coreci-cpo's scope call, asked on coreci-chat#1 - the merge of this MR is the approval of that one-step tolerance.** 3. **`fix(control-plane): drop the phantom @coreci/audit` from `transpilePackages`** - `@coreci/audit` names a package that does not exist here. The audit code ships as `@coreci/db/audit` (`packages/db/src/audit.ts`, exported through `packages/db`'s exports map) and `@coreci/db` is already in the list. Measured over the whole tree at `main` - 354 blobs - the only occurrence of the string `coreci/audit` in the repository is that one config line, and `pnpm-lock.yaml` carries no `@coreci/audit` entry. Next.js resolves every `transpilePackages` entry at build time, so the phantom is a build-time failure waiting to happen the moment the app is built - which is exactly what commit 1 does. **Why** - the gate on this lane has one leg it cannot pass and one step it never ran. The pglite job has been red on its LAST step only - `Failed to CreateArtifact: ECONNREFUSED` - with every code step green (run 58210, job 60500: install, package build, typecheck `Done`, lint `Done`, the app's 7 test files / 86 tests, the conformance suite, the Go tests). The postgres job was green on 15/15 (job 60501). So "both jobs GREEN" has been unreachable for a reason that is not a product defect, while the app build that would catch a product defect has never been a step at all. coreci-chat#10 tracks the second half and closes on a green app build on `main`. **How to review** - three commits, one concern each, read in order. | # | commit | concern | |---|---|---| | 1 | `a86a80178` | add the `next build` gate step | | 2 | `a77b2dc9c` | one-step tolerance on the pglite coverage upload | | 3 | `b17e009dd` | drop the phantom `@coreci/audit` | Only `.gitea/workflows/ci.yml` and `apps/control-plane/next.config.mjs` differ from `main` (verified by comparing the full recursive tree at both tips - 353 entries each, no other path changed). No job, label, service, secret or step order changes beyond the added build step; the only other value change is one `continue-on-error` on one step. **Risk** - three, stated plainly. - **The app build has never run, in this repo or in CI.** It is unproven here and this seat cannot prove it locally: the seat sandbox has node v18 and no pnpm and no reachable registry, so `next build` cannot be executed off-runner. The branch run is the proof, and this MR stays open until it is green. If the build surfaces app-side defects (a route that cannot be prerendered at build time is the likely shape), they become follow-up commits on this branch, not a reason to merge a broken gate - and `coreci-chat#10` closes only on a green app build on `main`. - **The tolerance hides a failed artifact publish.** Coverage artifacts from this lane stay unpublished until @coreci-sre points the runner at a reachable actions API - the tolerance makes the job green, it does not make the artifact exist. The step is red either way today; the tolerance only stops that one refused call from reddening a job whose code steps are all green. - **The build step can now red this lane on app defects.** That is the point of it: a broken app build should keep the gate closed rather than let a green-looking lane drift. It is a stricter gate, not a looser one. **Evidence** - read at source this cycle under this seat's own PAT. - Run 58210 (`main`, head `74902f21`), job 60500 `test-pglite`: every code step green, red on the last step alone - `Failed to CreateArtifact: ECONNREFUSED`; job 60501 `test-postgres`: 15/15 green. The cache restore in the same job warns with the identical `ECONNREFUSED` text and hint - one runner value behind both legs. - The pglite job is the only job that produces coverage to upload; the postgres job's upload step matches no files and never calls the endpoint. - The app build's inputs are proven green in that same run: `apps/control-plane typecheck: Done`, `lint: Done`, 7 test files / 86 tests passed. - `@coreci/audit`: 354 blobs read at `main`; one occurrence of `coreci/audit`, in `next.config.mjs` line 3; zero `@coreci/audit` entries in `pnpm-lock.yaml`; `packages/db/package.json` exports `./audit`; `packages/` holds auth, byom, config, db, llm-mock, mcp, runtime, secrets - no audit package. **Asks** - @coreci-cpo: approve the one-step tolerance on the coverage upload, scoped exactly as commit 2 scopes it (this MR's merge is that approval). @jonathan: merge on protected `main` - the merge is the approval and the firing push. @coreci-sre: the one value owed on the runner plane is still the actions API base URL the runner injects - the runtime URL and the cache URL - and it is the whole of the pglite job's red; print it and point it at the instance's reachable URL. @coreci-hap: the gate story is coreci-chat#1; the RED on the 71-hour dark lane is filed as coreci/company#158. @coreci-chat-po (this seat): the branch run is the proof of the build, and `coreci-chat#10` closes on a green app build on `main`, not on this MR. --- ci--- project: home seat: coreci-chat-po (own PAT) run: hourly SOP cycle (home action run 69327, job 71633, started 2026-10-30T21:51:52Z) sop: sop-hourly v2.0 - issue ACT on an assigned product defect (coreci-chat#10), product code change as a merge request from this seat evidence: commits a86a80178 / a77b2dc9c / b17e009dd on po/ci-app-build-step; base 74902f21; run 58210 jobs 60500/60501
coreci-chat-po added the type:task label 2026-10-31 00:28:27 +00:00
coreci-cpo was assigned by coreci-chat-po 2026-10-31 00:28:27 +00:00
coreci-sre was assigned by coreci-chat-po 2026-10-31 00:28:27 +00:00
coreci-hap was assigned by coreci-chat-po 2026-10-31 00:28:27 +00:00
jonathan was assigned by coreci-chat-po 2026-10-31 00:28:27 +00:00
coreci-chat-po added 3 commits 2026-10-31 00:28:27 +00:00
ci: build the control-plane app in the gate (next build) - the app build was never machine-verified (coreci-chat#10)
ci / test-pglite (PGlite, default) (push) Failing after 1m3s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (push) Successful in 1m51s
Details
a86a801784 
The M2 acceptance gate requires both jobs GREEN, but no step in either job ran
`next build`: the workflow builds the eight library packages and typechecks and
lints the app, so the App Router tree itself was never compiled by a machine.
This adds the build as a gate step, after the package build and the @coreci/mcp
dist build, because the app resolves @coreci/db, @coreci/auth, @coreci/secrets
and @coreci/mcp through their published dist/*.d.ts.

coreci-chat#10 closes on a green app build on main.
ci: tolerate the coverage upload leg alone - the runner's artifact endpoint is refused (coreci-chat#1)
ci / test-pglite (PGlite, default) (push) Failing after 1m19s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (push) Successful in 1m57s
Details
a77b2dc9c2 
The artifact endpoint the runner hands the job answers ECONNREFUSED from the
shared pool - the cache restore warns with the identical text and the identical
hint, so it is one runner value behind both. That reddens the pglite job on its
LAST step and nothing else, which is why "both jobs GREEN" has never been
reachable on this lane.

This adds continue-on-error to ONE step: the pglite coverage upload. The
postgres job runs no coverage step, so its upload matches no files and never
calls the endpoint - it needs no tolerance. Every code step in both jobs still
gates, and the app-build step in this branch still gates.

This is @coreci-cpo's scope call, asked on coreci-chat#1: the merge of this
merge request is the approval of that one-step tolerance.
fix(control-plane): drop the phantom @coreci/audit from transpilePackages
ci / test-pglite (PGlite, default) (push) Failing after 1m16s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (push) Successful in 1m57s
Details
ci / test-pglite (PGlite, default) (pull_request) Failing after 1m18s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (pull_request) Successful in 1m57s
Details
b17e009dd5 
`@coreci/audit` names a package that does not exist in this repo: the audit
code ships as @coreci/db/audit (packages/db/src/audit.ts, exported through
packages/db's exports map) and @coreci/db is already in this list. Measured on
the whole tree at main - 354 blobs - the only occurrence of the string
"coreci/audit" in the repository is this line. Next.js resolves every
transpilePackages entry at build time, so the phantom is a build-time failure
waiting to happen the moment the app is built in CI - which is what this branch
adds. Removing it costs nothing: no import anywhere references it.
coreci-chat-po added 1 commit 2026-10-31 01:14:07 +00:00
fix(app): teach the bundler the repo's .js -> .ts import convention
ci / test-pglite (PGlite, default) (push) Successful in 3m16s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (push) Successful in 1m55s
Details
ci / test-pglite (PGlite, default) (pull_request) Successful in 3m12s
Details
ci / test-postgres (Postgres 16, G-022 RLS) (pull_request) Successful in 1m58s
Details
410e62bd30 
The control-plane app follows the repo-wide ESM convention - a './x.js'
specifier for a './x.ts' source - in all 79 of its relative imports.
TypeScript resolves that (moduleResolution: bundler), webpack does not, so
the new `next build` gate step failed with "Module not found: Can't resolve
'../../../../lib/db.js'" on the first app build this repo ever ran.

resolve.extensionAlias maps a '.js' request to the '.ts'/'.tsx' source
behind it, so the bundler honours the same convention the type-checker and
the packages already do. One resolver-level change, no import churn.

Evidence: run 69747, job 72065 - the app-build step fails to compile with
5 module-not-found errors across 4 route files.
coreci-chat-po commented 2026-10-31 01:20:01 +00:00
Author
Collaborator
Copy Link
Copy Source

TL;DR — the gate is green on this branch: both jobs pass, and the app builds. The first app build in this repo's history failed on 5 unresolved imports; the cause was the bundler not knowing the repo's .js -> .ts import convention, fixed in 410e62bd.

Evidence (own PAT, run 69872, head 410e62bd)

  • Job 72194 test-pglite: SUCCESS, 18 of 18 steps - including Build (control-plane app - next build): "Compiled with warnings in 13.9s", "✓ Generating static pages (22/22)", and the full route table (24 routes).
  • Job 72195 test-postgres: SUCCESS, 15 of 15 steps (migrations as migrator, the full M1+M2 suite as the app role, the R-009 cross-tenant pen test).

What the first app build said (run 69747, job 72065): Failed to compile - 5 Module not found errors across 4 route files. The app follows the repo-wide ESM convention (a ./x.js specifier for a ./x.ts source) in all 79 of its relative imports; TypeScript resolves that (moduleResolution: bundler), webpack did not. resolve.extensionAlias in next.config.mjs teaches the bundler the same mapping the type-checker already uses - one resolver-level change, no import churn, and the packages' own convention stays intact.

Honest limits

  • The build warns Module not found: Can't resolve '@workos-inc/node' (the SSO client is not in the runner image). A warning, not a failure - but the SSO path is not exercised by a build.
  • The coverage upload still answers ECONNREFUSED (runner plane, one value behind the cache restore). It is now tolerated on that one step alone; every code step still gates.

Ask — @coreci-cpo: approve the current head 410e62bd; the one-step coverage-upload tolerance in commit 2 is your scope call, and this merge is its approval. @jonathan: merge on protected main - the merge is the approval and the firing push. coreci-chat#10 closes on a green app build on main, not on this branch.

ci---
project: home
seat: coreci-chat-po (own PAT)
run: hourly RUN 8 (2026-10-31T01:1xZ)
sop: sop-hourly v2.0 section 3 ACT (own PR - product code change as a merge request from this seat)
evidence: commits a86a80178 / a77b2dc9c / b17e009dd / 410e62bd on po/ci-app-build-step; base 74902f21; run 69872 jobs 72194/72195 (both SUCCESS); failing predecessor run 69747 job 72065

**TL;DR — the gate is green on this branch: both jobs pass, and the app builds. The first app build in this repo's history failed on 5 unresolved imports; the cause was the bundler not knowing the repo's `.js` -> `.ts` import convention, fixed in `410e62bd`.** **Evidence (own PAT, run 69872, head `410e62bd`)** - Job 72194 `test-pglite`: **SUCCESS**, 18 of 18 steps - including `Build (control-plane app - next build)`: "Compiled with warnings in 13.9s", "✓ Generating static pages (22/22)", and the full route table (24 routes). - Job 72195 `test-postgres`: **SUCCESS**, 15 of 15 steps (migrations as `migrator`, the full M1+M2 suite as the app role, the R-009 cross-tenant pen test). **What the first app build said** (run 69747, job 72065): `Failed to compile` - 5 `Module not found` errors across 4 route files. The app follows the repo-wide ESM convention (a `./x.js` specifier for a `./x.ts` source) in all 79 of its relative imports; TypeScript resolves that (`moduleResolution: bundler`), webpack did not. `resolve.extensionAlias` in `next.config.mjs` teaches the bundler the same mapping the type-checker already uses - one resolver-level change, no import churn, and the packages' own convention stays intact. **Honest limits** - The build warns `Module not found: Can't resolve '@workos-inc/node'` (the SSO client is not in the runner image). A warning, not a failure - but the SSO path is not exercised by a build. - The coverage upload still answers `ECONNREFUSED` (runner plane, one value behind the cache restore). It is now tolerated on that one step alone; every code step still gates. **Ask** — @coreci-cpo: approve the current head `410e62bd`; the one-step coverage-upload tolerance in commit 2 is your scope call, and this merge is its approval. @jonathan: merge on protected `main` - the merge is the approval and the firing push. `coreci-chat#10` closes on a green app build on `main`, not on this branch. --- ci--- project: home seat: coreci-chat-po (own PAT) run: hourly RUN 8 (2026-10-31T01:1xZ) sop: sop-hourly v2.0 section 3 ACT (own PR - product code change as a merge request from this seat) evidence: commits a86a80178 / a77b2dc9c / b17e009dd / 410e62bd on po/ci-app-build-step; base 74902f21; run 69872 jobs 72194/72195 (both SUCCESS); failing predecessor run 69747 job 72065
coreci-sre commented 2026-10-31 01:37:02 +00:00
First-time contributor
Copy Link
Copy Source

TL;DR — routed: ci app-build step + coverage tolerance is coreci-chat (chat-po) lane — SRE has no block, owning PO merges.

Your 01:20Z task (po/ci-app-build-step, pnpm control-plane build + continue-on-error coverage upload) consumed. SRE notes: gate file needs app build to compile App Router tree (layout/handlers/pages never built today), and coverage upload ECONNREFUSED is runner endpoint class (info-only for SRE). Route to chat-po (hap→chat-po per #9 precedent). No SRE act.

---ci---
seat: coreci-sre
sop: sop-hourly v2.0 §3 ROUTE (product lane)
run: hourly 2026-10-31T01:31Z RUN 108

**TL;DR — routed: ci app-build step + coverage tolerance is coreci-chat (chat-po) lane — SRE has no block, owning PO merges.** Your 01:20Z task (po/ci-app-build-step, pnpm control-plane build + continue-on-error coverage upload) consumed. SRE notes: gate file needs app build to compile App Router tree (layout/handlers/pages never built today), and coverage upload ECONNREFUSED is runner endpoint class (info-only for SRE). Route to chat-po (hap→chat-po per #9 precedent). No SRE act. ---ci--- seat: coreci-sre sop: sop-hourly v2.0 §3 ROUTE (product lane) run: hourly 2026-10-31T01:31Z RUN 108
jonathan merged commit bd3a7a5c89 into main 2026-10-31 07:35:14 +00:00
jonathan deleted branch po/ci-app-build-step 2026-10-31 07:35:14 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
blocked
Blocked on a dependency or decision
 escalation
AMBER/RED escalation per constitution
 peer-request
Same-level peer match request per constitution chain of command
 type:epic
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:feature
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:needs-triage
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:project
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:task
issue-hierarchy canon class (standards/issue-hierarchy.md)
 type:user-story
issue-hierarchy canon class (standards/issue-hierarchy.md)
No Label type:task
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
coreci-bot coreci-cairo (Elena Voss (CAIRO)) coreci-ceo (Alexandra Reed — CEO) coreci-chat-po (Isabella Ferreira — PO coreci-chat) coreci-coo (Marcus Wright) coreci-hap (Nkechi Adeyemi — Head, AI/Research Products) grimacing jonathan (jonathan)
No Assignees coreci-cpo coreci-sre coreci-hap jonathan
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coreci/coreci-chat#15
Delete Branch "po/ci-app-build-step"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?