promote: foundation batch and platform gates

.github/workflows/quality.yml

@@ -16,6 +16,7 @@ jobs:
   scope:
     name: Detect affected runtimes
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     outputs:
       shared: ${{ steps.scope.outputs.shared }}
       web: ${{ steps.scope.outputs.web }}
@@ -27,6 +28,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Detect change scope
         id: scope
         shell: bash
@@ -53,6 +55,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Set up Python 3.13
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
@@ -86,9 +90,12 @@ jobs:
     needs: scope
     if: needs.scope.outputs.engine == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Set up Python 3.13
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
@@ -117,6 +124,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Set up Java 21
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
         with:

.github/workflows/release.yml

@@ -18,9 +18,12 @@ jobs:
     name: Build and record release provenance
     runs-on: ubuntu-24.04
     environment: release
+    timeout-minutes: 30
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:

.github/workflows/security.yml

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:

docs/development/README.md

@@ -10,7 +10,8 @@ Android companion, API, and Python engine.
    OpenTofu when infrastructure validation is needed. The repository pins the
    package manager and checks runtime versions.
 2. Run `corepack pnpm repo:bootstrap`.
-3. Run `corepack pnpm repo:check` and `corepack pnpm repo:build`. A clean
+3. Run `corepack pnpm repo:check` and `corepack pnpm repo:build`. The check
+   includes non-applying local/AWS infrastructure validation. A clean
    checkout is the baseline; do not hide a failure with an untracked local
    configuration file.
 4. Copy `infrastructure/local/.env.example` to a local-only `.env` if needed,

docs/operations/engineering-foundation-verification.md

@@ -12,13 +12,13 @@ environment limits that remain explicit.
 
 | Area | Command | Result |
 |---|---|---|
-| JavaScript workspace | `corepack pnpm repo:check` | Pass; formatting, lint, typecheck, requirements, contracts, repository tests, and 19 Turborepo test tasks passed. |
+| JavaScript workspace | `corepack pnpm repo:check` | Pass; formatting, lint, typecheck, requirements, contracts, infrastructure policy, repository tests, and 19 Turborepo test tasks passed. |
 | JavaScript builds | `corepack pnpm repo:build` | Pass; API, Web, Desktop, shared packages, and engine package build completed. |
 | Contracts | `corepack pnpm --filter @databreeze/contracts contract:check` | Pass; generated models, compatibility baseline, and 28-case TypeScript/Python/Kotlin parity passed. |
 | Engine | `uv sync --locked --offline`; engine test/lint/typecheck/build through the root gates | Pass; locked Python 3.13 environment and package build verified. |
 | Android | `apps/android/gradlew :app:testDebugUnitTest --no-daemon` | Pass; 27 Gradle tasks completed. |
 | Brand | `corepack pnpm brand:check` and design-token build checks | Pass; canonical legacy asset checksums and derivatives remain unchanged. |
-| AWS static validation | `corepack pnpm infra:check` | Pass; static checks passed and no infrastructure was applied. |
+| AWS/static infrastructure | `corepack pnpm infra:check`; `node tools/repo-cli/src/local-services.mjs config` | Pass; static AWS checks and daemon-free local Compose validation passed; no infrastructure or containers were applied. |
 
 The contract drift check ignores only `uv`/Hatch editable-install products
 under `generated/python/build` and `generated/python/*.egg-info`; a regression
@@ -31,8 +31,10 @@ products are never committed.
   executed locally. CI must run them with the pinned OpenTofu release before
   an infrastructure change is approved.
 - Docker was not required for the repository gates and live local dependency
-  startup was not claimed. Run `corepack pnpm local:smoke` on a machine with a
-  healthy Docker daemon before dogfood acceptance.
+  startup was not claimed. Run `corepack pnpm local:services check` and then
+  `corepack pnpm local:services restart-check` on a machine with a healthy
+  Docker daemon before dogfood acceptance. See
+  `foundation-local-infrastructure-2026-08-02.md` for the FND-003 boundary.
 - Android instrumentation/emulator and signed release packaging are separate
   production-readiness gates; the shell unit test is the evidence recorded here.
 

docs/operations/foundation-batch-handoff-2026-08-02.md

@@ -0,0 +1,78 @@
+# Foundation batch handoff
+
+Observed at (UTC): 2026-08-02
+Canonical repository: `databreeze-platform`
+Branch: `feat/fnd003-local-infra-batch`
+Base: `origin/dev` at `92b3e9a4d581f3a6947b7a2bf58c8334f4ae0c18`
+Promotion base: `origin/main` at `a2fcba34037c1ffd77816be16be75453abfb16fa`
+
+## Active delivery boundary
+
+- FND-003 local infrastructure is `in-progress`. Static Compose, bootstrap,
+  lifecycle, port, Docker-diagnostic, disk-preflight, and daemon-free config
+  checks are committed.
+- Live Docker health, port-collision simulation, disk-pressure threshold, and
+  restart-persistence evidence remain environment-gated because the Docker
+  daemon is unavailable on the current machine.
+- The batch also hardens AWS static checks, content-safe telemetry handling,
+  infrastructure path-aware CI, and the updated 30–70 commit policy. These
+  changes are not marked as verified foundation tasks until their own gates are
+  recorded.
+
+## Verification already run
+
+- Local infrastructure, AWS infrastructure, CI policy, change-scope, telemetry,
+  orchestration, and diff checks pass in their scoped commands.
+- `node tools/repo-cli/src/local-services.mjs config` passes without a Docker
+  daemon; `check` fails closed with a clear daemon-unavailable reason.
+- Android lifecycle review fixes were promoted through PRs #17 and #18; the
+  existing PR #14 promotion was merged to `main` after hosted checks and its
+  single CodeRabbit review/incremental dispositions.
+
+## Git batching rule
+
+This is a normal feature batch. Keep atomic commits and do not open the feature
+PR until the branch reaches at least 30 commits, targeting approximately 70 and
+never reaching 100. The only small-PR exceptions are focused promotion-review
+fixes required to close an already-open `dev`→`main` gate.
+
+At this checkpoint the branch is 72 commits ahead of `origin/dev`. The current
+boundary is still coherent: FND-003 local lifecycle hardening is accompanied by
+portable AWS safety, telemetry, CI/supply-chain, and evidence updates. Continue
+with scoped foundation work until the final handoff boundary; do not manufacture
+empty commits or open a small feature PR merely to reset the count.
+
+## Final scoped verification before the feature PR
+
+Passed from this worktree:
+
+- `corepack pnpm format:check`
+- `corepack pnpm lint`
+- `corepack pnpm typecheck`
+- `corepack pnpm contracts:check`
+- `corepack pnpm orchestration:check`
+- `corepack pnpm requirements:check`
+- `corepack pnpm test` (67 repository CLI tests plus all workspace suites)
+- `corepack pnpm repo:build` (API, Web, Desktop, shared packages, and engine)
+- `uv run --locked pytest`, Ruff, format, and mypy (91 engine tests)
+- `apps/android/gradlew.bat :app:testDebugUnitTest --offline --no-daemon`
+
+Environment-gated and intentionally not claimed as verified:
+
+- OpenTofu format/init/validate because OpenTofu is not installed locally.
+- Live Docker startup, health, port-collision, disk-pressure, Redis
+  persistence, and restart checks because the Docker daemon is unavailable.
+- Android instrumentation/emulator and signed release packaging.
+
+## Safest next command
+
+```powershell
+git status --short --branch
+git fetch origin dev main
+node tools/repo-cli/src/check-execution-orchestration.mjs
+node --test tools/repo-cli/test/**/*.test.mjs
+```
+
+After the normal batch reaches its commit boundary, push this branch, open one
+PR to `dev` without CodeRabbit, merge after hosted checks, then create the
+separate `dev`→`main` promotion PR and invoke CodeRabbit exactly once there.

docs/operations/foundation-ci-supply-chain-2026-08-02.md

@@ -0,0 +1,51 @@
+# FND-006 CI and supply-chain evidence
+
+Observed at (UTC): 2026-08-02
+Branch: `feat/fnd003-local-infra-batch`
+Task: `FND-006 — Close CI and supply-chain gaps`
+
+## Implemented boundaries
+
+- Path-aware scope detection treats infrastructure, tooling, contracts, plans,
+  and workflows as shared quality-gate inputs.
+- Every required workflow uses SHA-pinned actions, least-privilege top-level
+  permissions, discarded checkout credentials, bounded runner timeouts, and
+  no `pull_request_target` or long-lived AWS credentials.
+- Artifact uploads fail when an expected output is missing.
+- SBOM and provenance generators reject malformed output arguments; provenance
+  fails closed when a declared artifact is missing and records sorted SHA-256
+  subjects.
+- Container image, secret-pattern, license, SBOM, and provenance checks remain
+  non-deploying repository operations.
+
+## Verification
+
+Passed:
+
+- `node --test tools/repo-cli/test/ci-policy.test.mjs`
+- `node --test tools/repo-cli/test/provenance.test.mjs`
+- `node --test tools/repo-cli/test/sbom.test.mjs`
+- `node tools/repo-cli/src/check-ci-policy.mjs`
+- `node tools/repo-cli/src/check-container-policy.mjs`
+- `node tools/repo-cli/src/check-secret-patterns.mjs`
+- `node tools/repo-cli/src/check-license-policy.mjs`
+- `node tools/repo-cli/src/generate-sbom.mjs --output <temporary-file>`
+- `node tools/repo-cli/src/generate-provenance.mjs --output <temporary-file> --artifact <temporary-sbom>`
+- `git diff --check`
+
+Hosted CI remains authoritative for the complete dependency, SAST, container,
+OpenTofu, build, and release-environment gates. The generators never write
+runtime evidence inside the repository during these checks.
+
+The `release` environment's required reviewers and branch restrictions are
+GitHub repository settings rather than workflow YAML. Before promoting to
+`main`, an administrator must verify those settings and record the check in
+the release evidence; the repository policy checker deliberately verifies the
+workflow's environment reference but cannot infer external protection rules.
+
+## Rollback
+
+Revert the focused CI or generator commit that introduced the behavior, rerun
+the scoped tests and `pnpm ci:policy`, then record the resulting gap before
+merging. No cloud resource, credential, or customer data is changed by these
+checks.

docs/operations/foundation-local-infrastructure-2026-08-02.md

@@ -0,0 +1,56 @@
+# FND-003 local infrastructure evidence
+
+Observed at (UTC): 2026-08-02
+Branch: `feat/fnd003-local-infra-batch`
+Task: `FND-003 — Close local infrastructure gaps`
+
+## Implemented boundaries
+
+- PostgreSQL 17.5, Redis 7.4.5, MinIO, Mailpit, and the OpenTelemetry collector
+  remain pinned in `infrastructure/local/compose.yml`.
+- PostgreSQL initialization creates every module-owned schema and contains no
+  credentials, roles, or secret literals.
+- `tools/repo-cli/src/local-services.mjs` provides daemon-free `config` and
+  `preflight` commands plus `check`, `start`, `stop`, `reset`,
+  `restart-check`, `status`, bounded read-only `logs`, and legacy `smoke`
+  commands.
+- Lifecycle commands preserve named volumes. `reset` uses Compose
+  `down --remove-orphans` without `--volumes`; data deletion is never implicit.
+- Preflight reports missing Docker CLI/daemon, host port collisions, and
+  insufficient free disk space before starting containers.
+- `restart-check` restarts the running stack and waits for every service health
+  check, providing the entry point for persistence evidence.
+- `persistence-check` writes a five-minute Redis sentinel, restarts only Redis,
+  verifies the sentinel, and deletes it; it never flushes a database or volume.
+- The documented lifecycle command set includes `config`, `preflight`, `check`,
+  `start`, `stop`, `reset`, `restart-check`, `persistence-check`, `status`,
+  `logs`, and the legacy `smoke` entry point.
+
+## Verification
+
+Passed:
+
+- `node --test tools/repo-cli/test/local-infrastructure.test.mjs`
+- `node tools/repo-cli/src/local-services.mjs --help`
+- `node tools/repo-cli/src/local-services-smoke.mjs --help`
+- `node tools/repo-cli/src/local-services.mjs config`
+- `node tools/repo-cli/src/local-services.mjs preflight --min-free-gib=0`
+- `git diff --check`
+
+Environment-gated:
+
+- `node tools/repo-cli/src/local-services.mjs check` fails closed with
+  `Docker daemon is unavailable` because no Docker daemon is running here.
+- The daemon-free `preflight` command completes Compose, port, and disk checks
+  without starting containers; the evidence run used a zero-GiB threshold so
+  it remains independent of the workstation's available disk headroom.
+- Live `compose up`, health polling, port-collision simulation, disk-pressure
+  threshold validation, and restart-persistence checks (including
+  `persistence-check`) must run on a machine with Docker Desktop/Compose v2
+  before FND-003 can become `verified`.
+
+## Rollback
+
+Revert the lifecycle commit and retain the prior static Compose checks. No
+containers, named volumes, host files, or credentials are modified by the
+repository changes.

docs/operations/foundation-reconciliation-2026-08-02.md

@@ -33,7 +33,7 @@ This record was created from the current merged `dev` checkpoint, not from an ea
 | Task 15 | reconciled | Electron main/preload/renderer shell, context isolation, CSP/navigation policy, and IPC boundary tests pass. |
 | Task 16 | reconciled | Python `uv` project, typed action registry, framed entry points, deterministic processor, and engine checks/build pass. |
 | Task 17 | reconciled | Kotlin/Compose shell, generated resources, Room/WorkManager/Keystore ports, network security, backup policy, and debug unit tests pass. |
-| Task 18 | reconciled | PostgreSQL/Redis/MinIO/Mailpit/OpenTelemetry Compose definitions, health checks, and static readiness checks pass; live Docker startup is separately environment-gated. |
+| Task 18 | reconciled-with-limit | PostgreSQL/Redis/MinIO/Mailpit/OpenTelemetry Compose definitions, health checks, explicit network/volume isolation, safe lifecycle commands, port/disk/Docker preflight, and daemon-free config checks pass; live Docker startup/restart persistence is separately environment-gated in FND-003. |
 | Task 19 | reconciled-with-limit | AWS OpenTofu modules, alpha composition, encryption/private-network/OIDC source checks, and non-applying infrastructure check pass; OpenTofu itself is not installed locally, so format/validate remain hosted-check obligations. |
 | Task 20 | reconciled | Content-safe telemetry package, correlation propagation, redaction allowlists, and hostile-attribute tests are present and covered by repository checks. |
 | Task 21 | reconciled | Path-aware quality/security/release workflows, pinned actions, least-privilege permissions, SBOM/provenance, and scan definitions are present and hosted checks pass. |
@@ -59,7 +59,7 @@ The repository checks include generated-contract drift, brand checksum/derivativ
 ## Known environment limits
 
 - OpenTofu is not installed on this workstation. No AWS infrastructure was applied; hosted CI must run the pinned OpenTofu format/validate checks before an infrastructure PR is accepted.
-- Docker is installed but live local dependency startup was not required for this reconciliation. Run `corepack pnpm local:smoke` on a healthy Docker daemon before dogfood acceptance.
+- Docker is installed but its daemon is unavailable for this reconciliation. Run `corepack pnpm local:services check`, `start`, and `restart-check` on a healthy Docker daemon before dogfood acceptance.
 - Android instrumentation/emulator testing and signed release packaging remain Plan 400 gates; the debug unit suite passed with the local SDK path supplied through `ANDROID_HOME`/`ANDROID_SDK_ROOT`.
 - No customer data or credentials were used. Ignored dependency caches, virtual environments, build output, and Gradle state remain untracked.
 

docs/operations/telemetry-safety.md

@@ -0,0 +1,33 @@
+# Content-safe telemetry boundary
+
+DataBreeze telemetry is operational metadata, not a source-data transport.
+Every runtime emits the versioned `@databreeze/telemetry/v1` shape and the
+Python/Kotlin mirrors are checked against its allowlist.
+
+## Allowed data
+
+- correlation, trace, workspace, job, artifact, dataset, and device IDs
+- bounded route/operation/outcome/reason/provider tokens
+- status, duration, queue, retry, item, byte, and redaction counters
+- an explicit sampling boolean
+
+## Prohibited data
+
+Paths, filenames, source values, formulas, document text, previews, evidence
+snippets, questions/prompts, transcripts, contact data, secrets, tokens,
+provider causes, and raw exception messages never enter ordinary telemetry.
+Unknown attributes are dropped. Strict assertion helpers reject unsafe records
+at adapter boundaries. JavaScript sanitization reads only own data properties,
+so accessor-backed diagnostics cannot execute arbitrary getters during logging.
+
+## Failure behavior
+
+Malformed correlation or trace headers fail closed. Ambiguous duplicate headers
+are rejected, including accessor-backed or non-string header values; hostile
+header mappings fail with a generic unreadable-header reason. Invalid or
+oversized values are omitted by the permissive sanitizer and rejected by strict mode. Providers and exporters remain
+replaceable; a collector outage cannot become domain authority or block durable
+jobs and audit writes.
+
+See `packages/telemetry/README.md` and the TypeScript/Python/Android parity
+tests before adding an attribute or event.

docs/plans/000-platform-program.md

@@ -48,7 +48,7 @@ docs/plans/requirement-traceability.json records all 611 IDs with requested trac
 - `main` contains stable releases. `dev` is the integration branch.
 - New capabilities use `feat/<name>`; corrections use `fix/<name>`; operational and documentation work use conventional prefixes when more accurate.
 - Commit one coherent tested unit at a time. Do not combine unrelated applications or domains merely to reduce commit count.
-- Feature/fix pull requests target `dev`, preferably contain 30–50 commits, and must not exceed 60 commits. Run local and hosted checks, but do not invoke CodeRabbit on these integration pull requests.
+- Feature/fix pull requests target `dev`, normally contain 30–70 commits, and must remain under 100 commits. Run local and hosted checks, but do not invoke CodeRabbit on these integration pull requests. Focused review-gate fixes are the only intentional small-PR exception.
 - Merge a green integration pull request while preserving its atomic rollback commits, then immediately open a separate `dev` → `main` promotion pull request for that completed batch.
 - Invoke CodeRabbit exactly once on the otherwise-ready promotion pull request and request a full review. Do not invoke it if the promotion exceeds 280 changed files; split or revert the batch first.
 - Reproduce every CodeRabbit claim against the reviewed commit. Fix valid findings in focused commits, document rejected findings with evidence, rerun all affected gates, and never request a second CodeRabbit review on that pull request.