fix: restore worker builds, Convex contracts and honest release gates

.gcloudignore

@@ -25,5 +25,8 @@ test-agents
 tmp-chrome-procs.txt
 tmp-playwright-*
 .npmrc
+# Root .npmrc contains only the public legacy-peer-deps install policy.
+!/.npmrc
 .env*
-!python-mcp-servers/langgraph_agent/.env
+packages/mcp-local/.mcpregistry_registry_token
+packages/mcp-local/.mcpregistry_github_token

.github/workflows/attrition-qa.yml

@@ -20,8 +20,9 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Crawl all surfaces
+        env:
+          BASE: ${{ github.event.inputs.api_url || 'https://scratchnode.live' }}
         run: |
-          BASE="${{ github.event.inputs.api_url || 'https://scratchnode.live' }}"
           if [[ "$BASE" == https://vercel.com/* ]]; then
             BASE="https://scratchnode.live"
           fi

.github/workflows/ci.yml

@@ -40,6 +40,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Install dependencies
+        id: typecheck_dependencies
         run: npm install --no-audit --no-fund
 
       - name: Convex bundle analysis (codegen)
@@ -55,8 +56,24 @@ jobs:
           CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
         run: npx convex codegen
 
-      - name: App typecheck
-        run: npx tsc --noEmit --pretty false
+      - name: Installed Convex generator contracts
+        if: ${{ !cancelled() && steps.typecheck_dependencies.outcome == 'success' }}
+        run: npm run test:convex-api-codegen
+
+      - name: App typecheck and generated API call contracts
+        # Codegen also typechecks the legacy backend. Keep that failure, but
+        # still collect the independent application result after installation.
+        if: ${{ !cancelled() && steps.typecheck_dependencies.outcome == 'success' }}
+        run: npm run typecheck:app
+
+      - name: Preserve actual application typecheck evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: app-typecheck-evidence
+          path: .tmp/app-typecheck/
+          if-no-files-found: warn
+          retention-days: 14
 
       - name: Convex typecheck
         run: npx tsc -p backend/convex --noEmit --pretty false
@@ -76,6 +93,9 @@ jobs:
       - name: Install dependencies
         run: npm install --no-audit --no-fund
 
+      - name: Workflow event data scenarios
+        run: node --test scripts/nodebench-packet-contracts.node.mjs
+
       - name: Runtime smoke tests
         run: >
           npx vitest run
@@ -91,6 +111,21 @@ jobs:
           backend/convex/domains/mcp/mcpSourcingDraft.integration.test.ts
           backend/convex/domains/mcp/mcpExecutionTraceEndpoints.integration.test.ts
           backend/convex/domains/agents/mcp_tools/models/modelResolver.test.ts
+          backend/convex/domains/pipelines/pipelineOwnership.auth.test.ts
+          backend/convex/domains/operations/__tests__/privacyAdmission.auth.test.ts
+          backend/convex/domains/operations/__tests__/privacyExecution.transactions.test.ts
+          backend/convex/domains/integrations/__tests__/telegramAdmission.test.ts
+          backend/convex/domains/agents/__tests__/delegationRegistration.test.ts
+          apps/web/src/lib/__tests__/convexApiQuery.test.tsx
+          backend/convex/domains/product/__tests__/preferencesReturnContract.test.ts
+          apps/web/src/lib/__tests__/preferencesReturnContract.test.tsx
+          apps/web/src/components/ai-ui/__tests__/sheet.test.tsx
+          apps/web/src/features/entities/components/EntityNotebookView.test.tsx
+          apps/web/src/features/entities/components/notebook/EntityNotebookLive.empty-state.test.tsx
+          apps/web/src/features/me/views/MeHome.test.tsx
+          apps/web/src/features/nudges/views/NudgesHome.test.tsx
+          apps/web/src/layouts/cockpitRails.test.tsx
+          backend/convex/domains/pipelines/pipelineTruthIsolation.test.ts
           apps/web/src/features/agents/components/FastAgentPanel/__tests__/RunState.test.tsx
           backend/convex/domains/agents/autonomy/autonomy.integration.test.ts
           backend/convex/domains/agents/autonomy/autonomyTasteBench.integration.test.ts
@@ -108,6 +143,16 @@ jobs:
           apps/web/src/features/redesign/components/UniversalComposer.test.tsx
           apps/web/src/features/redesign/surfaces/ScratchnodeEventsSurface.test.tsx
 
+      - name: Shared code renderer contracts
+        run: >
+          npx vitest run
+          apps/web/src/components/ai-elements/code-block.test.tsx
+          apps/web/src/shared/components/LazyCodeBlock.test.tsx
+          apps/web/src/shared/components/LazyCodeBlock.load-failure.test.tsx
+          apps/web/src/features/strategy/views/ExecutionTraceView.test.tsx
+          apps/web/src/features/strategy/views/ProductDirectionMemoView.test.tsx
+          --maxWorkers=2 --minWorkers=1 --no-file-parallelism
+
   scratchnode-launch-gates:
     name: ScratchNode launch gates
     runs-on: ubuntu-latest

.github/workflows/convex-mcp-eval-gate.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - 'packages/convex-mcp-nodebench/**'
       - 'scripts/eval-harness/**'
+      - '.github/workflows/convex-mcp-eval-gate.yml'
   schedule:
     # Nightly at 4 AM UTC
     - cron: '0 4 * * *'
@@ -19,7 +20,7 @@ on:
         default: 'tier1'
         type: string
       backend:
-        description: 'Agent backend (stub/anthropic/openai)'
+        description: 'Requested agent backend (anthropic/openai; execution not yet implemented)'
         default: 'anthropic'
         type: string
 
@@ -47,13 +48,10 @@ jobs:
         working-directory: packages/convex-mcp-nodebench
         run: npm test
 
-      - name: Run eval harness (Tier 1 deterministic)
+      - name: List evaluation task catalog (no agent execution)
         run: |
-          echo "=== Eval Harness: Tier 1 Tasks ==="
-          npx tsx scripts/eval-harness/runner.ts --list
-          echo "---"
-          echo "Gate check: convex-mcp-nodebench builds clean and all 16 tools / 27 tests pass."
-          echo "Full eval runs require agent invocation which is done in nightly CI."
+          node packages/convex-mcp-nodebench/node_modules/tsx/dist/cli.mjs scripts/eval-harness/runner.ts --list
+          echo "Package build and tests are checked above. This catalog does not certify provider-backed evaluations."
 
       - name: Upload eval results
         if: always()
@@ -85,7 +83,7 @@ jobs:
         working-directory: packages/convex-mcp-nodebench
         run: npm run build
 
-      - name: Run nightly eval suite (real agent invocation)
+      - name: Require provider-backed evaluation execution
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -99,9 +97,7 @@ jobs:
           echo "Backend: $EVAL_BACKEND"
           echo "Seeds: $EVAL_SEEDS"
           echo "Tasks: $EVAL_TASKS"
-          npx tsx scripts/eval-harness/runner.ts --list
-          # TODO: Replace --list with actual run once agentInvoker API calls are live:
-          # npx tsx scripts/eval-harness/runner.ts --task $EVAL_TASKS --seeds $EVAL_SEEDS
+          node packages/convex-mcp-nodebench/node_modules/tsx/dist/cli.mjs scripts/eval-harness/runner.ts --all --tasks "$EVAL_TASKS" --seeds "$EVAL_SEEDS"
 
       - name: Upload nightly results
         if: always()

.github/workflows/nodebench-packet.yml

@@ -1,6 +1,6 @@
 name: NodeBench Packet
-# Trigger: comment "@nodebench <company>" on any PR or issue
-# Result: posts a structured intelligence packet as a comment
+# A human comment "@nodebench <company>" requests a packet on an issue or PR.
+# Event and response text stay data; this privileged job checks out no source.
 
 on:
   issue_comment:
@@ -12,65 +12,77 @@ permissions:
 
 jobs:
   nodebench-packet:
-    if: contains(github.event.comment.body, '@nodebench')
+    if: contains(github.event.comment.body, '@nodebench') && github.event.comment.user.type != 'Bot'
     runs-on: ubuntu-latest
+    timeout-minutes: 3
     steps:
-      - name: Extract query from comment
-        id: extract
-        run: |
-          COMMENT="${{ github.event.comment.body }}"
-          QUERY=$(echo "$COMMENT" | sed 's/.*@nodebench //' | head -1 | tr -d '\n')
-          echo "query=$QUERY" >> $GITHUB_OUTPUT
-          echo "Extracted query: $QUERY"
-
-      - name: Run NodeBench search
-        id: search
+      - name: Request and post packet
+        uses: actions/github-script@v9
         env:
           NODEBENCH_API: ${{ secrets.NODEBENCH_API_URL || 'https://langgraph-agent-873372783709.us-central1.run.app' }}
-        run: |
-          RESULT=$(curl -sS -X POST "$NODEBENCH_API/api/pipeline/search" \
-            -H "Content-Type: application/json" \
-            -d "{\"query\": \"${{ steps.extract.outputs.query }}\", \"lens\": \"founder\"}" \
-            --max-time 60)
-
-          ENTITY=$(echo "$RESULT" | jq -r '.entityName // "Unknown"')
-          CONFIDENCE=$(echo "$RESULT" | jq -r '.confidence // 0')
-          ANSWER=$(echo "$RESULT" | jq -r '.answer // "No results"' | head -5)
-          SIGNALS=$(echo "$RESULT" | jq -r '.variables // [] | length')
-          SOURCES=$(echo "$RESULT" | jq -r '.sourceRefs // [] | length')
-
-          # Build markdown comment
-          cat << 'COMMENT_EOF' > comment.md
-          ## NodeBench Intelligence Packet
-
-          **Entity:** $ENTITY
-          **Confidence:** $CONFIDENCE%
-          **Sources:** $SOURCES | **Signals:** $SIGNALS
-
-          ### Summary
-          $ANSWER
-
-          ---
-          *Generated by [NodeBench](https://nodebenchai.com) Pipeline v2*
-          COMMENT_EOF
-
-          # Replace variables
-          sed -i "s/\$ENTITY/$ENTITY/g" comment.md
-          sed -i "s/\$CONFIDENCE/$CONFIDENCE/g" comment.md
-          sed -i "s/\$SOURCES/$SOURCES/g" comment.md
-          sed -i "s/\$SIGNALS/$SIGNALS/g" comment.md
-          sed -i "s/\$ANSWER/$ANSWER/g" comment.md
-
-      - name: Post comment
-        uses: actions/github-script@v9
         with:
           script: |
-            const fs = require('fs');
-            const body = fs.readFileSync('comment.md', 'utf8');
-            const issueNumber = context.issue.number;
+            const comment = context.payload.comment.body;
+            const query = comment.match(/[\s\S]*@nodebench([^\r\n]*)/i)?.[1]?.trim() || '';
+            if (!query || query.length > 2000) {
+              throw new Error('Supply a query of 1 to 2000 characters after @nodebench.');
+            }
+            const base = new URL(process.env.NODEBENCH_API);
+            if (base.protocol !== 'https:' || base.username || base.password ||
+                base.pathname !== '/' || base.search || base.hash) {
+              throw new Error('NODEBENCH_API must be a trusted HTTPS origin without credentials.');
+            }
+            const response = await fetch(new URL('/api/pipeline/search', base), {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({ query, lens: 'founder' }),
+              redirect: 'error',
+              signal: AbortSignal.timeout(60000),
+            });
+            if (!response.ok) {
+              await response.body?.cancel();
+              throw new Error(`NodeBench search failed with HTTP ${response.status}.`);
+            }
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder('utf-8', { fatal: true });
+            let bytes = 0;
+            let text = '';
+            try {
+              while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+                bytes += value.byteLength;
+                if (bytes > 256 * 1024) throw new Error('NodeBench response exceeds 256 KiB.');
+                text += decoder.decode(value, { stream: true });
+              }
+              text += decoder.decode();
+            } finally {
+              await reader.cancel().catch(() => {});
+              reader.releaseLock();
+            }
+            const packet = JSON.parse(text);
+            if (!packet || typeof packet !== 'object' || Array.isArray(packet) ||
+                packet.success === false || typeof packet.answer !== 'string') {
+              throw new Error('NodeBench returned an unsuccessful or malformed packet.');
+            }
+            const confidence = Number.isFinite(packet.confidence) &&
+              packet.confidence >= 0 && packet.confidence <= 100
+              ? `${packet.confidence}%` : 'Unavailable';
+            const entity = typeof packet.entityName === 'string'
+              ? packet.entityName.slice(0, 300) : 'Not supplied';
+            const sources = Array.isArray(packet.sourceRefs) ? packet.sourceRefs.length : 'Unavailable';
+            const signals = Array.isArray(packet.variables) ? packet.variables.length : 'Unavailable';
+            const answer = packet.answer.split('\n', 5).join('\n').slice(0, 4000);
+            const body = [
+              '## NodeBench Intelligence Packet', '',
+              `**Entity:** ${entity}`, `**Confidence:** ${confidence}`,
+              `**Sources:** ${sources} | **Signals:** ${signals}`, '',
+              '### Summary', answer, '', '---',
+              '*Generated by [NodeBench](https://nodebenchai.com) Pipeline v2*',
+            ].join('\n');
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: issueNumber,
-              body: body,
+              issue_number: context.issue.number,
+              body,
             });

.github/workflows/vercel-preflight.yml

@@ -33,7 +33,7 @@ jobs:
     env:
       CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
       VITE_CONVEX_URL: ${{ secrets.VITE_CONVEX_URL || vars.VITE_CONVEX_URL || vars.CONVEX_URL || secrets.CONVEX_URL }}
-      NODE_OPTIONS: --max-old-space-size=4096
+      NODE_OPTIONS: --max-old-space-size=6144
     steps:
       - uses: actions/checkout@v6