[sphilipse]

Summary

Adds a CI gate asserting on the Kibana server's runtime module graph: a dev Kibana is booted against a snapshot Elasticsearch with a require-graph preload, and once the server reports available the gate dumps every module in require.cache and fails if any banned browser-only or GenAI-stack package was loaded at startup.

This is a runtime check on purpose. The lint rule in #300920 catches direct imports, but static analysis cannot see dynamic imports that execute during startup — exactly the failure mode found (empirically) while building #300921, where a lazily-imported module was still loaded during initializeResources.

Pieces

• HEAP_TRACK_REQUIRE_ONLY=1 mode for the existing @kbn/heap-snapshot-analyzer-cli preload: records require edges + the SIGUSR1 dump, skips V8 allocation tracking so startup stays fast.
• node scripts/check_server_module_graph: boots ES + Kibana, waits for availability, settles, dumps, asserts, and tears everything down. On failure it prints per-package module counts and the exact modules importing into each banned package — the import sites to fix:

[module-graph-gate] FAILED — banned modules loaded by the server at startup (31,476 total modules):
[module-graph-gate]    1125  @elastic/eui
[module-graph-gate]     811  @langchain
...
[module-graph-gate] modules importing into each banned package (the import sites to fix):
[module-graph-gate]   @elastic/eui:
[module-graph-gate]     src/platform/packages/shared/kbn-cases-components/src/status/status.tsx
...

• A PR pipeline step (server_module_graph.yml, mirrors the OAS-snapshot step).

Banlist (zero tolerance, no allowlist)

@elastic/eui, refractor, prismjs, @elastic/apm-rum*, react-intl, react-use, react-redux, redux, @reduxjs/*, @langchain/*, langsmith, openai, gpt-tokenizer, js-tiktoken, @modelcontextprotocol/*, google-auth-library, zod-to-json-schema.

react, react-dom and @emotion/* are deliberately not banned: core's rendering service legitimately renders the bootstrap HTML template with React on the server.

⚠️ Blocked on

This gate is intentionally strict and will stay red until all of the following land (it must not be merged before them):

1. Split React/EUI exports of kbn-discover-utils into a components entry point #302019 Stop re-exporting React components from the kbn-search-connectors barrel #302020 Keep visualization color and constant imports EUI-free in server-reachable code #302021 Import CaseStatuses from the pure kbn-cases-components subpath #302022 Use pure user-profile subpaths and theme tokens in security server code #302023 Remove color code from Kibana server in Observability code #302024 Split EUI-dependent severity helpers out of the ml anomaly_utils barrel #302025 Split React code out of @kbn/ebt-tools and @kbn/ingest-pipelines-shared barrels for server consumers #302026 — the eight splits of Stop loading @elastic/eui and React UI libraries in the Kibana server #300920 (EUI off the server), plus the lint rule Lint-ban browser UI library imports in Kibana server code #302027
2. Lazy-load the GenAI/LLM dependency stack in the Kibana server #300921 — GenAI stack lazy-loaded
3. Three residue follow-ups flagged in those PRs: fleet agent_policy_settings.tsx (react-intl), share url_service (react-use useMountedState), aiops stream_reducer (@reduxjs/toolkit)

Verification

• End-to-end on this branch (which is based on main, so violations exist by construction): boots, dumps 31,476 modules, reports all 17 banned packages with exact counts and import sites, exits 1.
• Counting/edge-reporting unit tests (9) pass; @kbn/heap-snapshot-analyzer-cli type check and lint clean; .buildkite workspace typecheck clean.
• CI cost: one ES snapshot boot + one dev Kibana boot on a preemptible 4-vCPU agent (~6–10 min), parallel to other steps.

🤖 Generated with Claude Code

[infra-vault-gh-plugin-prod]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!
• Click to trigger kibana-static-checks for this PR!