Skip to content

feat(platform): establish greenfield process boundaries #392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mira-2026 wants to merge 3 commits into from
Open

feat(platform): establish greenfield process boundaries #392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f862ec8
feat(platform): establish greenfield process boundaries
mira-2026 Aug 6, 2026
c7790db
fix(platform): close boundary review findings
mira-2026 Aug 6, 2026
ba76c1f
test(platform): improve log quiescence diagnostics
mira-2026 Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/dashboard-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,30 @@ jobs:
- name: Install dependencies
run: bun install --frozen-lockfile

- name: Check source boundaries
run: bun run check:boundaries

- name: Test source-boundary checker
run: bun run test:boundaries

- name: Type-check browser source
run: bun run typecheck:browser

- name: Type-check contracts and shared source
run: bun run typecheck:contracts

- name: Type-check qualification probes
run: bun run typecheck:qualification

- name: Type-check repository scripts
run: bun run typecheck:scripts

- name: Type-check server source
run: bun run typecheck:server

- name: Type-check worker source
run: bun run typecheck:worker

- name: Test qualification probes
run: bun run test:qualification

Expand Down
296 changes: 289 additions & 7 deletions .oxlintrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
"denyWarnings": true,
"reportUnusedDisableDirectives": "error",
"typeAware": true,
"typeCheck": true
"typeCheck": false
},
"plugins": [
"eslint",
Expand Down Expand Up @@ -112,20 +112,72 @@
"backend/**/*.ts",
"frontend/src/test/**/*.{ts,tsx}",
"qualification/**/*.ts",
"scripts/**/*.ts",
"src/app/**/*.ts",
"src/server/**/*.ts",
"*.config.{js,mjs,cjs,ts}"
"scripts/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/app/dashboardServer.ts",
"src/app/environmentSource.ts",
"src/app/server.ts",
"src/app/trpcHttpHandler.ts",
"src/app/trpcRequestPolicy.ts",
"src/app/worker.ts",
"src/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/worker/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"*.config.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"globals": {
"Bun": "readonly"
}
},
{
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**",
"src/app/environmentSource.ts"
],
"files": [
"src/app/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/worker/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-restricted-properties": [
"error",
{
"message": "Read the process environment only through the typed environment source.",
"object": "process",
"property": "env"
},
{
"message": "Read the process environment only through the typed environment source.",
"object": "Bun",
"property": "env"
},
{
"message": "Read the process environment only through the typed environment source.",
"object": "Deno",
"property": "env"
}
]
}
},
{
"env": {
"browser": true
},
"files": ["frontend/src/**/*.{js,jsx,ts,tsx}"],
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": [
"frontend/src/**/*.{js,jsx,ts,tsx}",
"src/app/browser.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/browser/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"jsPlugins": ["oxlint-tailwindcss"],
"rules": {
"no-restricted-imports": [
Expand Down Expand Up @@ -161,7 +213,237 @@
}
},
{
"files": ["backend/src/**/*.ts", "src/app/**/*.ts", "src/server/**/*.ts"],
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": [
"src/contracts/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/shared/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-restricted-globals": [
"error",
{
"checkGlobalObject": true,
"globals": [
"Bun",
"Buffer",
"Deno",
"document",
"navigator",
"process",
"window"
]
}
],
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": [
"**/app/**",
"**/browser/**",
"**/qualification/**",
"**/scripts/**",
"**/server/**",
"**/worker/**",
"bun",
"bun:*",
"node:*"
],
"message": "Contracts and shared source must remain environment-neutral."
}
]
}
]
}
},
{
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": [
"src/app/browser.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/browser/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-restricted-globals": [
"error",
{
"checkGlobalObject": true,
"globals": ["Bun", "Buffer", "Deno", "process"]
}
],
"no-restricted-imports": [
"error",
{
"paths": [
{
"importNames": ["memo", "useCallback", "useMemo"],
"message": "React Compiler owns routine memoization; keep explicit memoization out of application code.",
"name": "react"
}
],
"patterns": [
{
"group": [
"**/app/**",
"**/qualification/**",
"**/scripts/**",
"**/server/**",
"**/worker/**",
"@simplewebauthn/server",
"@simplewebauthn/server/**",
"@trpc/server",
"@trpc/server/**",
"bun",
"bun:*",
"drizzle-orm",
"drizzle-orm/**",
"node:*"
],
"message": "Browser source may import only browser, contract, and environment-neutral shared modules."
}
]
}
]
}
},
{
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": ["src/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"],
"rules": {
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": [
"**/app/**",
"**/browser/**",
"**/qualification/**",
"**/scripts/**",
"**/worker/**"
],
"message": "Server source may import only server, contract, and environment-neutral shared modules."
}
]
}
]
}
},
{
"files": [
"src/app/dashboardServer.ts",
"src/app/server.ts",
"src/app/trpcHttpHandler.ts",
"src/app/trpcRequestPolicy.ts"
],
"rules": {
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": [
"**/browser/**",
"**/qualification/**",
"**/scripts/**",
"**/worker/**"
],
"message": "The web composition root may not import browser, worker, qualification, or script source."
}
]
}
]
}
},
{
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": [
"src/app/worker.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/worker/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": [
"**/app/**",
"**/browser/**",
"**/qualification/**",
"**/scripts/**",
"**/server/**"
],
"message": "Worker source may import only worker, contract, and environment-neutral shared modules."
}
]
}
]
}
},
{
"excludeFiles": [
"**/*.spec.*",
"**/*.test.*",
"**/__tests__/**",
"**/test/**",
"**/testSupport/**"
],
"files": [
"*.config.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"scripts/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-restricted-imports": [
"error",
{
"patterns": [
{
"group": [
"**/qualification/**",
"**/src/app/**",
"**/src/browser/**",
"**/src/server/**",
"**/src/worker/**"
],
"message": "Repository scripts may import only script, contract, and environment-neutral shared source."
}
]
}
]
}
},
{
"files": [
"backend/src/**/*.ts",
"src/app/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}",
"src/worker/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx}"
],
"rules": {
"no-console": "error"
}
Expand Down
3 changes: 3 additions & 0 deletions backend/src/requestPolicy/evaluator.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ async function callHandler(
server: Server<unknown>
): Promise<Response> {
if (handler instanceof Response) {
// The scripts graph sees Node's Undici clone return alongside Bun's
// stricter Response headers, while both are the same runtime object.
// oxlint-disable-next-line typescript/no-unnecessary-type-assertion
return handler.clone() as Response;
}
return handler(request, server);
Expand Down
2 changes: 1 addition & 1 deletion backend/test/utilityBehavior.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1278,7 +1278,7 @@ describe("backend service utilities", () => {
);

expect(response.status).toBe(503);
const payload = await response.json();
const payload: unknown = await response.json();
expect(payload).toMatchObject({
checks: {
database: {
Expand Down
3 changes: 3 additions & 0 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading