ci(scaffold-e2e): give the image run an explicit database (Refs #30120) - #30714

domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6a8d5ba86e0572df87abc5a1dc503e5e00911ce6
Local-runs: none
Scope: .github/workflows/scaffold-e2e.yml + docker/Dockerfile (on origin/main badf24df and on claude/project-thread-dj7jk6), packages/cli/src/commands/start.ts (both trees: the durability refusal the main #30120 PR adds), packages/runtime/src/resolve-project-database.ts (resolveProjectDatabaseUrl), packages/runtime/src/standalone-stack.ts (sqliteFilenameFromUrl), .github/workflows/docker-publish.yml (the only other workflow that runs the image)

Inputs read: card #30120 body and all 11 comments (ruling A3 = 6634240777; the seat's claim 6671522963 and its amendment 6671390478 naming this one-line separate PR); PR #30714 body, file list (one file, +1/-0) and net diff vs main (merge-base 788715ef, 1 ahead / 7 behind, applies cleanly); the 60 check-runs on this head.

① Derived judgments

• Accept-set / public surface: none. The diff is one -e OS_DATABASE_URL="iframe.php?url=file%3A%2Ftmp%2Fe2e.db" line inside the docker run of step "Docker build and run (scaffolded Dockerfile)". No package, schema, export or documented route moves. The PR body's Clause-②: no / Metadata-protocol: none lines are right; a workflow has neither face.
• Does the value satisfy the refusal the main PR adds? Yes. On claude/project-thread-dj7jk6, start.ts reads OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED (set true by that branch's docker/Dockerfile ENV) and refuses when missingDurableVariables({databaseSource, authSecretSet, secretKeySet}) is non-empty. databaseSource comes from resolveProjectDatabaseUrl: an OS_DATABASE_URL in the environment answers source: 'env' (step 1 of the resolution, before the config datasource and the two defaults), and isDefaultedDatabase is true only for 'unified-default' / 'legacy-file'. The two openssl rand -hex 32 secrets are non-empty after trim(). So missing is [] and the boot proceeds. The check runs before readOrCreateAuthSecret and before any database open, so nothing is written on a refusal either way.
• Is /tmp writable by the image's user? Yes. The image is FROM node:22-slim with USER node; /tmp in that base is the usual mode-1777 directory, and the Dockerfile's install RUN only removes its own /tmp/os-installer-npm. sqliteFilenameFromUrl('file:/tmp/e2e.db', 'sqlite') strips file: and yields /tmp/e2e.db; the SQLite sidecars (-wal, -shm) land in the same world-writable directory. The green Scaffold with repo dist run on this head already ran this exact docker run against the image built from main and probed health, so the path is measured, not inferred.
• Any other step that runs the image without the three variables? No. --name e2e / e2e-app occur only in this step. The two other boots in the workflow (npx os start --artifact ./dist/objectstack.json in scaffold-local and in registry-canary) run on the runner host, where the image's ENV signal is absent and the check stays off. docker-publish.yml runs the published image for os --version and a node_modules listing only, never os start.
• "The image does not read it today, zero behaviour change" (PR body) is overstated. resolveProjectDatabaseUrl reads OS_DATABASE_URL today too: on main the step's SQLite file moves from the unified default under the node user's home to /tmp/e2e.db. The health probe is indifferent to where the file is, so the conclusion (safe to land first) holds; only the wording is wrong. Prose, not tree.
• Ordering claim holds. Until the main PR lands the variable is harmless; once this line is on main, the main PR's pull_request run checks out the merge commit and so carries this line, which is why it must land before or with it.

② Semver level

skip-changeset is right: the PR publishes nothing from any released package (one governed workflow file). No changeset is owed. Check-runs on 6a8d5ba8: 60 runs, every one completed with success or skipped, including Scaffold with repo dist, Governed Surface Queue Guard, Check Changeset, Lint · CI, release & engine gates and PR-body guards; the commit-status API answers pending with zero statuses (no status contexts exist), which is not a red.

③ Boundary flags

• Dev flags / open_questions: none on the PR; the card's claim 6671390478 names this line and its reason.
• Author is objectstack-fleet[bot]; no out-of-relay login to name.
• Governed path: .github/workflows/** is Tier H. This record is the contract-tier review; the human approval the PR body asks for (os-zhuang or hotlong) is still owed before landing, and the main [Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120 PR must not land ahead of it.
• Independence: rendered by an isolated contract-review subagent fed the card, the PR, the diff, the cited trees and the check-runs, not the seat's conclusions; adopted by the seat named in Reviewed-by:.
• The PR is a draft and carries no needs:contract-review label; that is the dispatch seat's bookkeeping, not a finding.

④ Design judgment

hits = .github/workflows/scaffold-e2e.yml. The change holds against the code it cites and the scenario it is accepted against: the one leg that runs the official image gains the one variable the ruled refusal will demand that it did not already pass, with a value the resolver classifies as an explicit choice, pointing at a directory the image's non-root user can write, for a container that only has to answer /api/v1/health and is then removed. A mounted volume would add nothing to a health probe; :memory: would depend on the retired-engine refusal text and buys nothing over a file. The three names stay in step with missingDurableVariables by construction (the refusal names exactly OS_DATABASE_URL, OS_AUTH_SECRET, OS_SECRET_KEY).

Findings (none must-fix):

• should-fix — the added line is the only unannotated decision in a step whose every other line is explained. After [Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120 lands, a reader sees a throwaway SQLite path set explicitly with no reason. One comment line naming the image's OS_DEPLOYMENT_DURABILITY_CHECK_ENABLED refusal ([Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120) would keep the step self-describing and tell a future editor the variable cannot be dropped.
• should-fix (prose only) — PR body "今天镜像不读它,零行为变化 / the variable is simply unused": the resolver reads it today and relocates the step's SQLite file to /tmp/e2e.db. Say "the probe does not care where the file is" instead; the landing order argument does not depend on the stronger claim.

Implemented-by: claude/issue-30120-scaffold-e2e-db-url
Reviewed-by: session_016WV4cytQjG9X1CrCgytUM5

VERDICT: PASS

domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5

ACCEPT · Refs #30120 · 2026-11-05T23:27Z · Head-sha: 6a8d5ba86e0572df87abc5a1dc503e5e00911ce6

维护者速读

• 改了什么：CI 的脚手架端到端测试里，跑官方镜像那一步多传一个数据库地址（本地 SQLite 文件）。
• 为什么：[Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120 按你裁的 A3，官方镜像缺数据库地址或两个密钥就拒绝启动；这一步原来只传两个密钥，主 PR 落地后它会变红。
• 影响：只动 CI 一行，不影响任何发布的包和用户；现在合进去也安全，只是把测试用的 SQLite 文件位置换到 /tmp。
• 风险：无。契约复审 PASS（6672153152），本 head 60 个检查全绿。
• 顺序：必须先于或与 [Decision] os start in production mode runs on a local SQLite file and self-generated secrets, with no warning #30120 主 PR（fix(cli, service-settings, console): the official image refuses to start without its database and secrets; administrators see what a production server keeps on its own disk #30720）一起合入。
• 需要你做的：这是受管路径（.github/workflows/**），需要 os-zhuang 或 hotlong 批准本 head；批准后席位落地。

席位意见： 建议批准。一行、可逆、已在本 head 的 CI 里实测跑通。

席位核对

1. Shape: one file, +1/−0, .github/workflows/scaffold-e2e.yml step "Docker build and run (scaffolded Dockerfile)": -e OS_DATABASE_URL="iframe.php?url=file%3A%2Ftmp%2Fe2e.db". Diff read at this head.
2. Premise, measured: contract review 6672153152 (PASS, CONTRACT_REVIEW_TIER, this head) traced the value through resolveProjectDatabaseUrl (source: 'env') against the main PR's refusal on claude/project-thread-dj7jk6, /tmp writable under USER node, and no other workflow step running the image without the three variables.
3. Gates: 38 derived, 38 exit 0 (--ran reconciled). Check-runs on this head: 47 success, 15 skipped, 0 failed.
4. Accepted deviations / corrections: PR body correction — "the image does not read it today / zero behaviour change" is overstated: the resolver reads OS_DATABASE_URL today and the step's SQLite file moves to /tmp/e2e.db; the health probe is indifferent, so the landing order holds. Review should-fix 1 (an explanatory comment on the new line) is dropped: dropping the line would turn this job red on the next run, which names the cause, and a comment-only push would move the approved head.
5. Out of scope: none.
6. Landing: check-governed-merges: governed (Tier H). pm:awaiting-merge added; reviewers os-zhuang and hotlong requested in this stroke. Lands before or with fix(cli, service-settings, console): the official image refuses to start without its database and secrets; administrators see what a production server keeps on its own disk #30720.