Skip to content

feat(ato): Surface Activation v2 + vite production build lane - #1231

Merged
Koh0920 merged 6 commits into
mainfrom
feat/surface-activation-v2
Aug 2, 2026
Merged

feat(ato): Surface Activation v2 + vite production build lane#1231
Koh0920 merged 6 commits into
mainfrom
feat/surface-activation-v2

Conversation

@Koh0920

@Koh0920 Koh0920 commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Merges the staging-verified Surface Activation v2 arc (ready ack v2 public-surface activation + the vite production-build lane that fixed the 30s ready→visible gap; drawdb-3 FCP 8.1s→1.46s measured on staging) plus the ato#1155 hardware evidence doc.

Already deployed and verified on the staging builder (Sugamo) and exercised by every staging intake since. This PR lands the source on main; it is also the base of the ADR-016 CPU-entitlement stack (#1225#1226#1228).

Supersedes #1229 (identical patch-ids for both vite commits — verified with git patch-id --stable).

🤖 Generated with Claude Code

Koh0920 added 6 commits August 1, 2026 23:20
…builder

A builder's scratch directory is not a durable record, and a number in a PR
comment is only as good as the log behind it. This is the raw 10/10 run that
gated the merge, plus the steps to regenerate it — an unreproducible measurement
is an anecdote.

Records the caveats alongside the result rather than only the result: ten runs is
not a p99 sample; the E2E supplies its own AcceptanceConfig, so what was measured
is the WORK and not the production budget path; and the production builder held
no live job during the window, so contention classification A rests on the lock
namespaces being structurally separate plus no interference observed, not on a
contended run.

Carries the two product findings the run produced (ato#1157 vsock leak,
ato#1160 unbounded capture retry) and the warning that
run-uffd-kvm-smokes.sh is unusable on a live runner.

Stored as .txt because .gitignore excludes *.log — the point is that this file
is tracked.
…erver

Community capsules inferred from a package.json whose scripts declare plain
`vite build` + `vite preview` now launch
`sh -lc "<pm> run build && <pm> run preview -- --host 0.0.0.0 --port 8000 --strictPort"`
instead of the dev server. Dev serving shipped the unbundled module graph
through the app proxy — measured for drawdb: 448 requests / 115 MB before
first paint (the 'ready but blank for ~30s' preview); swagger-editor's graph
is 542 modules and never finishes booting. The build runs once at snapshot
capture (restores resume the serving process), and the pinned v1 lane grants
build-then-serve commands the capped 600 s boot budget for that capture.
Compound build scripts or a missing preview script keep the dev lane
(fail-closed, unchanged behavior).

Claude-Session: https://claude.ai/code/session_015MNKB1dibFqVffp5UQcg8V
…at boot

The first cut launched `sh -lc "npm run build && npm run preview …"` — but
the v1 guest rootfs is mounted read-only (only tool-owned cache paths are
tmpfs-redirected), so `vite build` writing dist/ dies on EROFS at boot and
the capture burns its whole readiness budget (observed twice on the staging
builder: 600 s spent, guest never healthy; the same build in an equivalent
2-cpu/6 GiB container takes 11 s).

The build now runs as part of image assembly: build_v1 chains
`<pm> run build` after dependency install when the launch is
`<pm> run preview …` and package.json declares a plain `… vite build`
script (vite_production_prebuild_cmd — evidence-based and fail-closed, same
doctrine as base_image_and_install). The inferred launch becomes a plain
`<pm> run preview -- --host 0.0.0.0 --port 8000 --strictPort` argv with the
standard 60 s readiness, and dist/ ships read-only in the identity-bearing
guest tree. The now-unneeded shell-compound seal arm and capture boot-budget
special case are reverted.

Claude-Session: https://claude.ai/code/session_015MNKB1dibFqVffp5UQcg8V
The 9 rootfs_builder tests that execute a real `sh` builder script (npm-ci
classification, stderr redaction/truncation) or rely on unix staging-dir
semantics fail on Windows CI, where sh isn't the shell — same platform gating
as the render-budget tests already on main.

Claude-Session: https://claude.ai/code/session_015MNKB1dibFqVffp5UQcg8V
@Koh0920
Koh0920 merged commit a1c489c into main Aug 2, 2026
26 checks passed
Koh0920 added a commit that referenced this pull request Aug 2, 2026
feat(ato): Surface Activation v2 + vite production build lane
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant