Gate hardened container in CI

Author: Gini

.github/workflows/ci.yml

@@ -27,3 +27,40 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check
+
+  container:
+    name: Hardened container smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build --tag onevibe:${{ github.sha }} .
+      - name: Start read-only container
+        run: |
+          docker run --detach --init --name onevibe-ci \
+            --publish 4311:4311 \
+            --read-only \
+            --tmpfs /tmp:size=64m,noexec,nosuid \
+            --tmpfs /var/lib/onevibe:size=64m,uid=10001,gid=10001,mode=700 \
+            --cap-drop ALL \
+            --security-opt no-new-privileges:true \
+            --env ONEVIBE_API_HOST=0.0.0.0 \
+            --env ONEVIBE_API_PORT=4311 \
+            --env ONEVIBE_DATA_DIR=/var/lib/onevibe \
+            onevibe:${{ github.sha }}
+      - name: Verify health and non-root runtime
+        run: |
+          for attempt in $(seq 1 30); do
+            if curl --fail --silent http://127.0.0.1:4311/api/health > /tmp/onevibe-health.json; then break; fi
+            sleep 1
+          done
+          grep -q '"status":"healthy"' /tmp/onevibe-health.json
+          test "$(docker exec onevibe-ci id -u)" = "10001"
+          test "$(docker inspect --format '{{.Config.User}}' onevibe-ci)" = "onevibe"
+      - name: Collect container logs
+        if: always()
+        run: docker logs onevibe-ci 2>&1 || true
+      - name: Remove container
+        if: always()
+        run: docker rm --force onevibe-ci || true

AGENTS.md

@@ -17,7 +17,7 @@ ONEVibe is an open-source, Manus-like agent workspace built as a thin product la
 
 ## Verification
 
-- `npm run check` is the minimum local gate.
+- `npm run check` is the minimum local gate. The GitHub workflow also builds the Docker image and runs a non-root, read-only container smoke test; when Docker is available locally, use `docker build --tag onevibe-ci:local .` and the equivalent flags from `.github/workflows/ci.yml` before changing the container contract.
 - UI work must be inspected in the browser at desktop and mobile widths.
 - A feature is complete only when its real enforcement path is exercised; otherwise call it a demo, adapter, preview, or contract.
 
@@ -59,7 +59,7 @@ For local Claude E2E, use the protected host-only LiteLLM relay configuration do
 
 The Better Auth foundation is feature-gated by `ONEVIBE_AUTH_ENABLED=true`. It must fail closed when `BETTER_AUTH_SECRET` or the real OTP webhook is missing. In authenticated local mode, newly created data is scoped by the server-derived user ID; legacy ownerless data is inaccessible. Do not enable it in a deployed environment until every data-plane repository has user/org scope, legacy import is explicit, and the production email path is accepted. Never add a fake OTP, browser-returned OTP, or development console OTP to make the login appear complete.
 
-Run `npm run e2e:auth-owner` for the local auth/ownership proof. It uses a loopback mail-catcher to receive the OTP generated by Better Auth, then verifies two real session cookies, unauthenticated `401`, owner-only reads, and cross-user `404` task/project/tag boundaries. The fixture is test delivery infrastructure only; it is not a production email or auth-bypass path.
+Run `npm run e2e:auth-owner` for the local auth/ownership proof. It uses a loopback mail-catcher to receive the OTP generated by Better Auth, then verifies two real session cookies, unauthenticated `401`, owner-only inventories, cross-user `404` task/project/project-file/schedule/MCP boundaries, and bounded MCP health ownership. The fixture is test delivery infrastructure only; it is not a production email or auth-bypass path.
 
 The Postgres target contract lives in `server/db/schema.ts` and `server/db/migrations/`; run `npm run db:check` and regenerate only through the reviewed Drizzle config. `npm run db:import -- --dry-run` is the safe first inspection of legacy data; the write path requires `DATABASE_URL`, an existing Better Auth owner, and explicit owner assignment for ownerless records. Do not flip `DATABASE_URL` into production behavior until the TaskStore repository adapter, transaction boundaries, restart/idempotency tests, and deployment migration procedure exist. A passing schema generator or import dry-run is not evidence that the application is using Postgres.
 

TODO.md

@@ -66,7 +66,7 @@ Reference: `plan/04-cloud-infrastructure.md`
 
 - [ ] **P4-01** Add auth — feature-gated Better Auth + hashed email-OTP foundation, real delivery webhook, session middleware, login UI, and hardcoded-identity removal are now implemented locally; keep open until production delivery, all route/session acceptance, and Postgres-backed ownership are complete
 - [ ] **P4-02** Migrate database — Drizzle/PostgreSQL schema contract, two migrations, owner-required importer, cross-owner relationship validation, disposable live import/restart proof, and a fail-closed persistence-driver guard are now present; keep open until the TaskStore repository adapter, production legacy import, application-level idempotency proof, and a controlled `DATABASE_URL` runtime switch are complete
-- [ ] **P4-03** Containerise — current non-root multi-stage `Dockerfile`, hardened SQLite-volume `docker-compose.yml`, and `.env.example` are implemented; keep open until the P4-02 Postgres contract is wired into the image/Compose path rather than shipping an unused database service
+- [ ] **P4-03** Containerise — current non-root multi-stage `Dockerfile`, hardened SQLite-volume `docker-compose.yml`, `.env.example`, and a GitHub Actions build/non-root/read-only smoke gate are implemented; keep open until the P4-02 Postgres contract is wired into the image/Compose path rather than shipping an unused database service
 - [ ] **P4-04** Deploy to Railway or Fly.io — `railway.toml` or `fly.toml`; deploy instructions in `plan/04-cloud-infrastructure.md#deploy`
 - [ ] **P4-05** Add cloud sandbox — integrate **e2b.dev** (`@e2b/code-interpreter`) as the default `sandboxed` execution backend; surface sandbox preview URL in workspace iframe; `E2bRuntimeAdapter` wraps e2b and implements the full `RuntimeAdapter` interface
 - [ ] **P4-06** Add multi-tenancy scaffolding — local user ownership now scopes tasks, projects, schedules, conversations, MCP declarations, and task routes; the authenticated two-user HTTP harness now covers cross-user task/project/file/schedule/MCP reads and mutations; keep open until `orgs`/`org_members`, Postgres ownership, migration/import, and exhaustive HTTP negative coverage for every route are complete

docs/IMPLEMENTATION-LOG.md

@@ -1,5 +1,11 @@
 # Implementation log
 
+## 2026-07-17 — enforce the hardened container contract in CI
+
+- Added a separate GitHub Actions container job that builds the multi-stage image, starts it with a read-only root filesystem, no-new-privileges, dropped capabilities, and an ephemeral writable data mount, then verifies `/api/health` and UID 10001.
+- Local verification passed with `docker build`, the same security flags, `/api/health`, Compose config validation, and explicit non-root identity checks. The data mount is deliberate: persistence is writable, while the image root remains immutable.
+- This improves the P4-03 container release gate but does not claim Postgres runtime support, cloud deployment, or sandbox isolation.
+
 ## 2026-07-17 — add bounded MCP health probing
 
 - Added `GET /api/mcp/:id/health`, scoped through the authenticated owner inventory, which starts the declared stdio server with the existing secret-free environment boundary, performs initialization and `tools/list`, and returns only `online`/`offline`, bounded latency, tool count, and generic failure detail.

docs/LINEAR-BOARD.md

@@ -26,7 +26,7 @@ The runtime registry work is tracked in [ONE-247](https://linear.app/onecomputer
 
 The conversation-branching Phase 2 gap is now tracked in [ONE-250](https://linear.app/onecomputer/issue/ONE-250/bep1-add-durable-conversation-branching-and-edit-message). Commit `66f4d22` implements the local branch endpoint, assistant-ui edit action, immutable source transcript, independent workspace copy, lineage/evidence metadata, and persistence/isolation tests. Cloud authorization, multi-user isolation, sandbox isolation, and live provider acceptance remain open.
 
-The cloud/container foundation is tracked in [ONE-251](https://linear.app/onecomputer/issue/ONE-251/platp1-containerize-onevibe-with-truthful-persistence-and-deployment). The current local slice has a non-root, hardened Docker/Compose runtime with a persistent SQLite volume and health smoke proof. It is intentionally not complete until Postgres/Drizzle, auth/user scoping, managed deployment, and sandbox attestation are wired without decorative or unused services.
+The cloud/container foundation is tracked in [ONE-251](https://linear.app/onecomputer/issue/ONE-251/platp1-containerize-onevibe-with-truthful-persistence-and-deployment). The current local slice has a non-root, hardened Docker/Compose runtime with a persistent SQLite volume, health smoke proof, and a GitHub Actions image/non-root/read-only smoke gate. It is intentionally not complete until Postgres/Drizzle, auth/user scoping, managed deployment, and sandbox attestation are wired without decorative or unused services.
 
 The first MCP extension slice is tracked in [ONE-252](https://linear.app/onecomputer/issue/ONE-252/extp1-add-governed-mcp-configuration-and-adapter-injection). The local implementation adds SQLite v6 persistence, audited CRUD, strict command/argument validation, a Computers-view configuration surface, a bounded per-server health/tool-catalog probe, and secret-free injection into tool-capable Claude SDK turns. It is intentionally not production MCP governance: authenticated ownership, secret brokering, external-server health/attestation, and per-organization isolation remain open under P4/P6.