Agent RPC MCP: merge the data and management planes, and make the branch production-ready (SHARK-3524, SHARK-3373)

.dockerignore

@@ -1,6 +1,6 @@
 # Keep secrets and build/dev cruft out of the build context and image layers.
-# The Dockerfile uses explicit COPY today; this is defense-in-depth so a future
-# `COPY . .` can never bake a key or local env into an image layer.
+# Both Dockerfiles use explicit COPY today; this is defense-in-depth so a future
+# `COPY . .` can never bake the RS256 signing key or a local env into a layer.
 .git
 .gitignore
 node_modules
@@ -13,6 +13,7 @@ deploy
 # Secrets / local env — never in an image layer.
 *.pem
 *.key
+*.crt
 .env
 .env.*
 

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
         # version comes from package.json "packageManager" (pnpm@11.8.0)
       - uses: actions/setup-node@v7
         with:
-          node-version: 23
+          node-version: 24
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile
       - name: Audit (high+)
@@ -30,3 +30,19 @@ jobs:
         run: pnpm build
       - name: Test
         run: pnpm test
+      # Coverage was measured by hand and quoted in REVIEW-READY.md while CI read
+      # neither number, so the thresholds constrained nothing and the next PR
+      # could erode them silently. Both scripts carry their own thresholds and
+      # exit non-zero below them (global 90/80/85, mgmt 80/75/80), so no
+      # threshold is restated here where it could drift from the script.
+      #
+      # Measured on the commit that added this step: global 98.65 lines /
+      # 88.61 branches / 95.11 functions, mgmt 99.02 / 88.91 / 96.17. Branch
+      # coverage moves by a few hundredths between runs because some branches are
+      # timing dependent (the session sweeper's interval, the child-process
+      # polls), so the margin above the branch thresholds is the real headroom:
+      # roughly 8 points on each, not a rounding error.
+      - name: Coverage (global)
+        run: pnpm test:coverage
+      - name: Coverage (management plane)
+        run: pnpm test:coverage:mgmt

.github/workflows/publish.yml

@@ -24,7 +24,7 @@ jobs:
         # version comes from package.json "packageManager" (pnpm@11.8.0)
       - uses: actions/setup-node@v7
         with:
-          node-version: 23
+          node-version: 24
           registry-url: https://registry.npmjs.org
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile

.gitignore

@@ -7,6 +7,7 @@ dist
 .DS_Store
 .vscode
 
+*.pem
 *.key
 *.crt
 venv
@@ -16,4 +17,9 @@ output.json
 *.sarif
 .codacy/cli
 .codacy-cli-bin
-.codacy-cli-runner.sh
+.codacy-cli-runner.sh
+# Coverage + mutation testing artifacts (G4/G5)
+coverage
+reports
+.stryker-tmp
+.stryker-tmp-obs

.husky/pre-commit

@@ -0,0 +1,50 @@
+#!/usr/bin/env sh
+# Refuse to commit unresolved conflict content.
+#
+# Why this hook exists: during the merge of the data plane into the management
+# branch, a `git add -A` staged four files with their conflict markers still in
+# them. In a normal tree that command is merely broad; in a conflicted merge it
+# also CLEARS the unmerged flag, so git stops calling those files conflicted and
+# a plain `git commit` would have recorded `<<<<<<<` into the history of a
+# security-critical file. Nothing else in the battery would have caught it in
+# time: prettier and eslint do not parse a conflicted file into a useful error,
+# and the suite fails long after the commit exists.
+#
+# Two independent checks, because they fail differently:
+#   1. staged CONTENT carrying markers  -> the git add -A case above
+#   2. an unresolved merge still open   -> committing mid-merge by accident
+#
+# Deliberately greps the staged blob (`git show :file`), not the working tree:
+# the working tree can be clean while the index holds the bad version.
+
+fail=0
+
+for f in $(git diff --cached --name-only --diff-filter=ACMR); do
+  case "$f" in
+    *.lock|pnpm-lock.yaml|package-lock.json) ;;
+    *)
+      if git show ":$f" 2>/dev/null | grep -qE '^(<<<<<<< |>>>>>>> |=======$)'; then
+        echo "conflict markers in staged content: $f"
+        fail=1
+      fi
+      ;;
+  esac
+done
+
+if [ -f "$(git rev-parse --git-dir)/MERGE_HEAD" ]; then
+  unresolved=$(git diff --name-only --diff-filter=U)
+  if [ -n "$unresolved" ]; then
+    echo "a merge is in progress and these paths are still unresolved:"
+    echo "$unresolved" | sed 's/^/  /'
+    fail=1
+  fi
+fi
+
+if [ "$fail" != "0" ]; then
+  echo ""
+  echo "Refusing the commit. Resolve the paths above, stage them BY NAME"
+  echo "(never 'git add -A' during a merge — it marks conflicts resolved), then"
+  echo "re-check with:"
+  echo "  git diff --name-only --diff-filter=U"
+  exit 1
+fi

.prettierignore

@@ -1,8 +1,14 @@
 dist
 node_modules
-static
+static/img
+static/llms.txt
+static/remote.html
 pnpm-lock.yaml
 .codacy
 .codacy-cli-bin
 .codacy-cli-runner.sh
 codacy-cli.sh
+reports
+.stryker-tmp
+.stryker-tmp-obs
+coverage