Wave 1: harden, test & CI-gate the Cloudflare Worker (production-grade roadmap)

[hyperpolymath]

What & why

First wave of the agreed 8-phase production-grade roadmap. This wave is the in-repo, no-external-dependency work that turns the only running software — the Cloudflare Worker registry API — from broken and untested into hardened, tested, and CI-gated.

🔴 Before this PR the Worker would not even load: worker/src/index.js imported ./verisimdb.js, but the file is verisim.js. There were no tests, no linter, no JS toolchain, and no CI exercising the Worker at all.

Changes

Worker — fix & harden (worker/src/*)

• Fixed the dead import (the showstopper).
• Top-level try/catch → controlled 500 (no isolate crashes).
• Input validation: clade whitelist (12 codes), NaN/oversized pagination clamps, safe URI decode, bounded query length.
• Security headers on every response (CSP default-src 'none', nosniff, HSTS, X-Frame-Options: DENY).
• Structured JSON logging with per-request ids; optional native rate limiting (fails open).
• New /v1/ready readiness probe (reports degraded on KV fallback) and a scheduled() cron handler to refresh the snapshot.
• Helpers split into http / log / validate / ratelimit modules.

Toolchain + tests (worker/package.json, test/)

• Vitest + ESLint (flat) + Prettier; lockfile for reproducible npm ci.
• 30 tests: routing, validation, headers, pagination, search/LLM, 405/404/503/500 paths, KV-fallback queries, a fuzz sweep (no uncontrolled 5xx), and a contract test enforcing the 12-clade invariant + snapshot count consistency.

Data fix — Phase 0 reconcile (worker/data/index.json)

• The snapshot claimed total_repos: 202 while carrying 203 repos, and game-server-admin (ix) was missing from clade membership. Regenerated → internally consistent (203 / 203 / member-sum 203). The new contract test prevents this drift from recurring.

CI/CD (.github/workflows/)

• worker-ci.yml — lint, format, test, wrangler deploy --dry-run on every PR/push (the gate that actually tests the deliverable).
• worker-deploy.yml — staging on merge to main, production via manual dispatch; skips cleanly (stays green) until CLOUDFLARE_API_TOKEN is set.
• Fixed malformed JSON quoting in boj-build.yml.

Hygiene

• Fixed the /var$REPOS_DIR path bug in sync/deploy-clade-a2ml.sh + parse-repos.sh (now derive paths from script location; REPOS_DIR overridable). Verified: parse-repos.sh emits 203 rows.
• Added .well-known/groove/manifest.json (service discovery).
• wrangler.toml: VERISIMDB_URL/DATA_SOURCE_URL, observability, hourly cron, rate-limiter binding, staging environment.
• Stopped tracking local .wrangler/ dev state.
• STATE.a2ml: honest status (Phase 3 → 60%; external blockers recorded).

Verified locally

eslint clean · prettier --check clean · 30/30 tests pass · wrangler deploy --dry-run passes for both top-level and --env staging.

Constraints respected

Worker stays plain JavaScript (no TypeScript — per AGENTIC.a2ml); MPL-2.0 headers; canonical file locations.

Next steps (need you)

1. Add CLOUDFLARE_API_TOKEN repo secret → unlocks auto-deploy to staging.
2. Phase 2: stand up VeriSimDB on the VPS → flip the Worker from KV fallback to live data (/v1/ready → ready).

Deferred to follow-ups (tracked in the plan)

Placeholder sweep via just init; full ROADMAP.adoc/README.adoc/TEST-NEEDS.md rewrite; src/interface/ffi/ cleanup; Phases 1–8 proper.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 73 issues detected

Severity	Count
🔴 Critical	1
🟠 High	11
🟡 Medium	61

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "missing_timeout_minutes",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence