Production hardening: correctness, verification and release gates

.env.example

@@ -1,22 +1,83 @@
-# AI Provider Keys (configure at least one)
+# -----------------------------------------------------------------------------
+# Codebase OS environment template
+# Copy only the values you actually need into your local .env. Never commit keys.
+# -----------------------------------------------------------------------------
+
+# Provider credentials (configure one or more).
 OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 GEMINI_API_KEY=
 OPENROUTER_API_KEY=
 
-# Default AI provider: openai | anthropic | gemini | openrouter | ollama
-COS_DEFAULT_PROVIDER=anthropic
-COS_DEFAULT_MODEL=claude-3-5-sonnet-20241022
-
-# Ollama (local models)
+# Ollama is credential-free by default.
 OLLAMA_BASE_URL=http://localhost:11434
-OLLAMA_MODEL=codellama:34b
 
-# Storage
-COS_DATA_DIR=.cos
+# Optional provider-wide generation-model overrides.
+# OPENAI_MODEL=gpt-5.6
+# ANTHROPIC_MODEL=claude-opus-4-1-20250805
+# GEMINI_MODEL=gemini-3.5-flash
+
+# Optional semantic-role overrides. These take precedence over provider defaults.
+# COS_OPENAI_REASONING_HIGH_MODEL=gpt-5.6
+# COS_OPENAI_REASONING_FAST_MODEL=gpt-5.6
+# COS_ANTHROPIC_REASONING_HIGH_MODEL=claude-opus-4-1-20250805
+# COS_ANTHROPIC_REASONING_FAST_MODEL=claude-sonnet-4-20250514
+# COS_GEMINI_REASONING_HIGH_MODEL=gemini-3.5-flash
+# COS_GEMINI_ANALYSIS_FAST_MODEL=gemini-3.6-flash
+
+# Embedding model overrides.
+# OPENAI_EMBEDDING_MODEL=text-embedding-3-small
+# GEMINI_EMBEDDING_MODEL=gemini-embedding-2
+
+# Provider/account rate controls. Set these to the actual limits of your account.
+# OPENAI_RPM=50
+# OPENAI_TPM=30000
+# OPENAI_MAX_CONCURRENCY=5
+# ANTHROPIC_RPM=40
+# ANTHROPIC_TPM=30000
+# ANTHROPIC_MAX_CONCURRENCY=3
+# GEMINI_RPM=50
+# GEMINI_TPM=100000
+# GEMINI_MAX_CONCURRENCY=3
+
+# Conservative context limits can be overridden when your configured model/account
+# has a verified different limit.
+# OPENAI_CONTEXT_WINDOW=128000
+# OPENAI_MAX_OUTPUT_TOKENS=32000
+# ANTHROPIC_CONTEXT_WINDOW=200000
+# ANTHROPIC_MAX_OUTPUT_TOKENS=8192
+# GEMINI_CONTEXT_WINDOW=128000
+# GEMINI_MAX_OUTPUT_TOKENS=8192
+
+# Logging / dashboard.
 COS_LOG_LEVEL=info
+# COS_DASHBOARD_PORT=3000
+
+# Sandbox resource limits.
+# COS_SANDBOX_CPUS=1.0
+# COS_SANDBOX_MEMORY=2g
+# COS_SANDBOX_TIMEOUT_MS=300000
+# COS_SANDBOX_MAX_OUTPUT_BYTES=2000000
+
+# Language-specific Docker image overrides.
+# COS_SANDBOX_NODE_IMAGE=node:20-bookworm-slim
+# COS_SANDBOX_PYTHON_IMAGE=python:3.12-slim
+# COS_SANDBOX_GO_IMAGE=golang:1.24-bookworm
+# COS_SANDBOX_RUST_IMAGE=rust:1-bookworm
+# COS_SANDBOX_MAVEN_IMAGE=maven:3.9-eclipse-temurin-21
+# COS_SANDBOX_GRADLE_IMAGE=gradle:8-jdk21
+# COS_SANDBOX_JAVA_IMAGE=eclipse-temurin:21-jdk
+# COS_SANDBOX_DOTNET_IMAGE=mcr.microsoft.com/dotnet/sdk:8.0
+# COS_SANDBOX_BUN_IMAGE=oven/bun:1
+# COS_SANDBOX_SWIFT_IMAGE=swift:6.0-bookworm
+# COS_SANDBOX_DART_IMAGE=dart:stable
+# Flutter has no Codebase OS default image. Pin a reviewed image explicitly:
+# COS_SANDBOX_FLUTTER_IMAGE=
+
+# By default the sandbox does NOT inherit application environment variables.
+# Explicitly list non-secret variables a build/test truly needs.
+# COS_SANDBOX_ENV_ALLOW=NODE_ENV,FEATURE_FLAG_FOR_TESTS
 
-# Environment Orchestration
-COS_DOCKER_SOCKET=/var/run/docker.sock
-COS_AUTO_RESOLVE_PORTS=true
-COS_AUTO_RESOLVE_RUNTIMES=true
+# Native host execution is disabled when Docker is unavailable. This is a
+# reduced-isolation escape hatch and should remain off for untrusted repositories.
+# COS_ALLOW_NATIVE_SANDBOX=1

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - agent/**
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify Node 20
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Typecheck, build and tests
+        run: npm run verify
+
+      - name: Verify publish payload
+        run: npm pack --dry-run

.github/workflows/post-remediation-verify.yml

@@ -0,0 +1,85 @@
+name: Post-remediation verification
+
+# Emit focused failure excerpts for the repository audit.
+on:
+  push:
+    branches:
+      - agent/production-hardening
+    paths:
+      - .github/workflows/post-remediation-verify.yml
+
+permissions:
+  contents: write
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: agent/production-hardening
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Run full post-remediation verification and record evidence
+        shell: bash
+        run: |
+          set +e
+          npm ci > /tmp/npm-ci.log 2>&1
+          CI_EXIT=$?
+
+          VERIFY_EXIT=99
+          if [ "$CI_EXIT" -eq 0 ]; then
+            npm run verify > /tmp/verify.log 2>&1
+            VERIFY_EXIT=$?
+          else
+            printf '%s\n' 'Skipped because npm ci failed.' > /tmp/verify.log
+          fi
+
+          AUDIT_EXIT=99
+          if [ "$CI_EXIT" -eq 0 ]; then
+            npm audit --omit=dev --audit-level=high > /tmp/audit.log 2>&1
+            AUDIT_EXIT=$?
+          else
+            printf '%s\n' 'Skipped because npm ci failed.' > /tmp/audit.log
+          fi
+
+          PACK_EXIT=99
+          if [ "$CI_EXIT" -eq 0 ]; then
+            npm pack --dry-run > /tmp/pack.log 2>&1
+            PACK_EXIT=$?
+          else
+            printf '%s\n' 'Skipped because npm ci failed.' > /tmp/pack.log
+          fi
+
+          {
+            echo "commit=$(git rev-parse HEAD)"
+            echo "node=$(node --version)"
+            echo "npm=$(npm --version)"
+            echo "npm_ci_exit=$CI_EXIT"
+            echo "verify_exit=$VERIFY_EXIT"
+            echo "audit_exit=$AUDIT_EXIT"
+            echo "pack_exit=$PACK_EXIT"
+            echo "--- npm ci tail ---"
+            tail -n 20 /tmp/npm-ci.log
+            echo "--- failing test excerpts ---"
+            grep -n -B 8 -A 20 '^not ok' /tmp/verify.log || true
+            echo "--- verify tail ---"
+            tail -n 60 /tmp/verify.log
+            echo "--- audit tail ---"
+            tail -n 30 /tmp/audit.log
+            echo "--- pack tail ---"
+            tail -n 20 /tmp/pack.log
+          } > .post-remediation-verification.txt
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -- .post-remediation-verification.txt
+          git commit -m "chore: record post-remediation verification evidence"
+          git push origin HEAD:agent/production-hardening

.github/workflows/security.yml

@@ -0,0 +1,39 @@
+name: Security
+
+on:
+  push:
+    branches:
+      - main
+      - agent/**
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-audit:
+    name: Production dependency audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Reject high or critical production dependency advisories
+        run: npm audit --omit=dev --audit-level=high