Repository navigation
Restore secure locked backend tests and add Overwatch CI #2
Description
Current gap and evidence — 2026-09-27
The CI and setup-documentation changes are already on the single existing draft PR #1, head ed825bf1c2c4c19eb3de99ad46564c5803bb4a39. A fresh Git commit read verifies this source commit's valid SSH signature. The earlier statements that the patch is unpublished or that the PR has zero checks describe the old 11f32c5 head, not the current branch.
The current workflow source defines both stable jobs. Run 36305664862 records frontend-typecheck-vitest-build success and backend-lint-and-locked-tests failure. The decoded backend job 108581702145 was read directly: Python 3.13.12 installed successfully, then python scripts/ci_prerequisites.py --ci reported BLOCKED: missing_authorized_tscore_index_token, exit 2, before dependency installation, backend lint or backend tests. This is a failed prerequisite, not a backend test pass. No unchanged rerun was triggered.
CI_ACCEPTANCE.md contains the clean-checkout commands, existing named-index/subprocess-keyring authentication routes, supported Python, credential boundaries and the separate fresh producer/UI gate. The source documentation and check visibility are verified; actual authorized authentication and full backend execution are not.
Remaining prerequisites: restore the existing approved local/private-index route and the reviewed overwatch-ci protected-environment route for a current TSCORE_CODEARTIFACT_TOKEN, then perform the unchanged locked install and complete supported backend suite. Token presence alone is not authentication proof. This session did not read or configure current secret values, change environment/AWS permissions, replace dependencies or access the running primary workstation service. The previous workstation receipt records HTTP 401 for typesafe==0.2.2; it has not been rerun from this runtime. Keep this issue open and PR #1 draft until the outstanding checks and live gates pass.
This is an environment and release gate, not a reason to remove private dependencies or relax Python >=3.13.12,<3.14.
Acceptance
- Restore the existing authorized, secret-safe private-index authentication route for local/CI locked installs; no token in repo, logs or issue comments.
- Run uv run --locked pytest -q under supported Python and report pass/fail/skip counts, including existing Sky/Flow and the Layev pipeline test when its fresh snapshot prerequisite is present.
- Add stable backend lint/test and frontend typecheck/Vitest/build checks on pull requests, and ensure PR Integrate Layev model runs into Overwatch #1 shows their results before review/merge. Source/check-visibility delivery only: the backend result is failure, not acceptance.
- Document reproducible clean-checkout commands and distinguish missing credentials from code/test failures. Documentation verified at the pinned CI_ACCEPTANCE.md above; authenticated command execution remains outstanding.
A green frontend, an installed Python runtime or a skipped pipeline cannot satisfy either unchecked criterion or the fresh producer-to-visible-UI gate in #3. Existing dependencies and their acceptance requirements remain unchanged.
Historical execution-session evidence — 2026-09-27; unpublished/zero-check status superseded above
A CI/preflight/documentation patch is implemented in the execution-session source bundle, based on 11f32c597f3763137b041e7d867d346e782b3bf9. It is not committed, pushed, enabled or hosted-validated. Live readback of PR #1's head still returned zero check runs.
The patch defines stable backend-lint-and-locked-tests and frontend-typecheck-vitest-build jobs with commit-pinned checkout/setup actions, Python 3.13.12, unchanged locked backend dependencies, explicit skip reporting, and separate credential-free frontend jobs. It preserves typesafe/tspath on the existing named tscore index and the existing subprocess-keyring route. Neither pyproject.toml nor uv.lock is modified.
The hosted route requires maintainers to configure the protected overwatch-ci environment and bind an already authorized, current CodeArtifact token as TSCORE_CODEARTIFACT_TOKEN. No token was obtained or configured by this session. It is exposed only to prerequisite/install steps via the documented named-index variables; no pull_request_target, cloud deployment or secret/cache artifact upload is added. The source preflight exits 2 rather than silently passing when the runtime, same-repository identity or token prerequisite is missing. Token presence is explicitly not authentication proof.
Measured result: 16/16 pure prerequisite/workflow contract tests passed on isolated Python 3.13.5. This runtime is below Overwatch's supported minimum; these are not the locked backend suite, Ruff, real frontend application checks or the fresh Layev pipeline. Patch application and exact postimage comparison also passed.
Artifact: overwatch-ci.patch, SHA-256 2a7007954eb1bd5f0a76e3389d0331dc9db2b3c8dda5eb4ccafdd5435e167a73. The source bundle includes docs/CI_ACCEPTANCE.md with clean-checkout commands, credential boundaries and the separate populated-UI gate.
Exact remaining blockers: supported Python and authorized private-index access in a connected execution environment, configured verified SSH signing for delivery to the existing PR #1 branch, successful hosted checks, and the fresh producer prerequisite for #3. This session cannot access the primary workstation checkout or its running service. Keep this issue open and PR #1 draft; do not substitute these source tests for backend acceptance.
Historical Windows primary-checkout integration — 2026-09-27
The CI source patch is now committed as verified SSH-signed commit ed825bf on the existing draft PR #1: #1. Focused cache/CI source tests passed 44/44 on isolated Python 3.13.12; Ruff passed; hosted frontend-typecheck-vitest-build passed on that head.
The hosted backend-lint-and-locked-tests job failed at the intended fail-closed preflight with missing_authorized_tscore_index_token. A local locked install still receives HTTP 401 for typesafe==0.2.2. The full supported backend suite, authenticated clean install and fresh producer-to-UI gate are not claimed. The repository currently has no configured overwatch-ci environment secret; keep this issue open.
Activity
CompleteDotTech commentedon Sep 28, 2026
Fresh PR #1 CI prerequisite readback: the TypeSafe CodeArtifact
tscoreindex URL is already inpyproject.toml/uv.lock, but the liveoverwatch-cienvironment has zero secrets and zero protection rules. The workflow expects environment secretTSCORE_CODEARTIFACT_TOKENasUV_INDEX_TSCORE_PASSWORD; run36360190467failed at the credential prerequisite, so locked install, backend Ruff and tests were skipped. Repo API reports admin permission, so the empty secret list is authoritative. Local public Ruff 0.16.5ruff check src tests scriptspasses on clean headaef1938, but does not replace locked backend CI. An authorized short-lived token source and reviewer configuration remain necessary. #2 and draft PR #1 stay open.CompleteDotTech commentedon Sep 28, 2026
Independent partial backend evidence on clean PR #1 head
aef193862499734af552860744db667b64afebd1: on Ubuntu WSL with supported Python 3.13.12, an isolated environment containing the public dependencies at the repository's pinned direct versions ran the full current Python test suite with the genuine two-step Layev export supplied to the native pipeline test. Command shape:PYTHONPATH=src KEV_LAYA_SNAPSHOT=<real-training-export> python -m pytest -q -ra. Result: 120 passed, 0 skipped, with five upstream SkyPilot/SQLAlchemy deprecation warnings. The real local producer-to-cache-to-report test is included in that count; its source export and private receipt hashes are recorded on #3. Separately, full-tree Ruff with the currentuv.lockpinruff==0.16.5passed (ruff check src tests scripts).This was not
uv sync --lockedoruv run --lockedand did not install the private TypeSafe/tspath distributions. The required private CodeArtifact token route is still unavailable; hosted backend preflight fails before the locked install, while the frontend hosted check passes. Therefore the first two acceptance boxes remain open and PR #1 remains draft. No credential was printed or stored in the repo.CompleteDotTech commentedon Sep 28, 2026
Credential-route finding (2026-09-28; backend gate still open): the existing
tscoreuv index points to AWS CodeArtifact domaintypesafe, owner905418454283, repositorytscore, regionus-east-1. The CI job expectsUV_INDEX_TSCORE_PASSWORDfrom theoverwatch-cienvironment secretTSCORE_CODEARTIFACT_TOKEN; neither that environment nor the repository currently has a usable secret. The local locked install reaches the private index but receives HTTP 401 for lockedtspath==0.2.6. No index URL, package pin or Python requirement needs changing.AWS says a token must be minted by an authorized IAM identity with
codeartifact:GetAuthorizationTokenandsts:GetServiceBearerToken; package reads also needcodeartifact:ReadFromRepository. Tokens expire within 12 hours, so a one-time static GitHub secret is not a durable CI route. The preferred durable setup is a narrowly scoped AWS role assumed by a protectedoverwatch-ciGitHub OIDC job, which mints a fresh token per run. The environment needs an effective trusted-code/reviewer gate before that role is exposed to PR code. An authorized local AWS SSO/profile could mint a short-lived token for the local locked suite. The AWS role/profile, trust policy and read grant must come from the TypeSafe account owner; they are not present or inferable from this checkout.No token was obtained, logged or committed. The supported locked install, Ruff/full pytest and hosted backend job remain unverified; PR #1 stays draft. Primary references: AWS token lifetime and IAM, AWS repository permissions, uv CodeArtifact credentials, GitHub OIDC for AWS.