Prepare cloud-backed knowledge runtime diagnostics

[andrei-hasna]

Summary

• Add cloud runtime diagnostics for local SQLite, env-selected PostgreSQL catalog modes, local/S3 generated artifacts, hosted API env names, privacy gates, and migration approval gates.
• Expose runtime metadata through storage contracts and db storage status, plus public storage exports and generated dist/bin output.
• Document cloud-backed migration boundaries in docs/migration/cloud-backed-runtime.md and README.

Validation

• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun test tests/storage-contract.test.ts tests/storage.test.ts tests/hosted-config.test.ts tests/cli.test.ts tests/sync.test.ts: 65 pass, 1 fail. Failure: existing machines topology local-marker assertion in tests/cli.test.ts; the same test passes when run alone and machine topology source files were not changed.
• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun test tests/cli.test.ts --test-name-pattern 'setup, auth, and remote commands expose hosted-aware JSON contracts|setup can opt into canonical example S3 artifact storage|db init and stats create project knowledge.db': 3 pass.
• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun test tests/storage.test.ts: 5 pass.
• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun test tests/cli.test.ts --test-name-pattern 'db storage status reports remote catalog env names without leaking database URLs': 1 pass.
• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun run build: pass.
• Focused built CLI smoke from temp HOME/project: hosted canonical setup selected S3, storage status reported s3://example-knowledge-prod/.hasna/knowledge/, db local mode reported local, db remote mode reported active env name HASNA_KNOWLEDGE_DATABASE_URL without leaking the database URL, remote contracts preserved raw_source_bytes_stored_in_open_knowledge=false.
• TMPDIR=$PWD/.openloops/tmp BUN_INSTALL_CACHE_DIR=$PWD/.openloops/bun-cache bun test: 146 pass, 2 skip, 1 fail. Same existing machines topology local-marker assertion; it passes in isolation.
• git diff --check: pass.
• Staged secrets scan: no matches.

Safety

• No production AWS/RDS/S3 mutation, secret creation, Terraform apply, spend increase, live migration, or bulk private upload performed.
• Conversations and Mementos writes from this sandbox were blocked by readonly home databases; evidence was recorded in the Todos task instead.

[andrei-hasna]

Post-amend CI note: commit 743017a fixes the worker-introduced macOS path assertion in the new db storage runtime tests. The new db storage status local and remote no-leak tests pass in the fetched macOS logs.

Remaining visible macOS failures are existing temp-path canonicalization expectations outside this task: tests/mcp.test.ts workspace_home and tests/cli.test.ts project/machines workspace_home expect /var/folders/... while the CLI returns /private/var/folders/.... No cloud-runtime diagnostic failure was visible in the fetched failed logs.

[andrei-hasna]

Merge-review worker update for task 17ece359-d3e2-4f71-8b73-03d81c658c9e: not merged.

Current hard blockers:

• CI is red on run 28748129814. The concrete macOS failures are existing path canonicalization assertions outside the cloud-runtime diff: tests/mcp.test.ts:774, tests/cli.test.ts:555, and tests/cli.test.ts:836 expect /var/folders/... while runtime returns /private/var/folders/.... Other matrix jobs are failed/cancelled as a result.
• No non-author GitHub review is recorded: latestReviews is empty and reviewDecision is empty.

Merge-safety evidence checked:

• PR Prepare cloud-backed knowledge runtime diagnostics #11 is open, non-draft, branch-fresh, and GitHub reports it mergeable, but mergeStateStatus is UNSTABLE.
• Local validation on PR head 743017a passed: bun test --timeout 20000 (148 pass, 2 skip, 0 fail), focused diagnostics CLI tests, bun run build, bun scripts/verify-generated-artifacts.mjs, and git diff --check.
• PR diff secret scan found no obvious credential values; diagnostics report env var names rather than database URL values.
• Independent adversarial reviewer agreed not to merge until CI is green or explicitly waived and review evidence exists.

Follow-up todos created:

• 8b68851e: fix macOS temp path CI blockers for Prepare cloud-backed knowledge runtime diagnostics #11.
• 5804aee3: non-author GitHub review for Prepare cloud-backed knowledge runtime diagnostics #11.

[andrei-hasna]

Closing as superseded/obsolete.

This PR (opened 2026-07-05) proposed client-visible cloud-runtime diagnostics built on a THREE-mode catalog model — KnowledgeCatalogRuntimeMode = 'local' | 'hybrid' | 'remote' with remote_postgres.supported_modes = ['hybrid','remote'] configured by a client-side HASNA_KNOWLEDGE_DATABASE_URL.

That model was replaced the next day by #12 ("cloud-backed knowledge store: vendored storage kit + PURE REMOTE cloud mode", merged 2026-07-06) and is now the state of main (reconciled to the published 0.2.86/0.2.87 line via #31):

• Amendment A1 (PURE REMOTE): StorageMode is now only local | cloud; hybrid, remote, and self_hosted are DEPRECATED aliases that normalize to cloud.
• The client-side Postgres sync engine (getStoragePg/storagePush/storagePull/storageSync/runStorageMigrations) was REMOVED as a forbidden DSN-on-client path; presence of a DATABASE_URL no longer auto-enables cloud; server-side cloud access is intentionally kept out of the CLI/MCP/SDK client surface.
• knowledge db storage status and knowledge storage status already exist on main.

Rebasing this PR would reintroduce the deprecated three-mode client catalog surface and the client-side DATABASE_URL path that were deliberately removed for security. The remaining benign bits (S3 artifact/hosted-API/privacy-gate diagnostics) would need a full re-implementation against the new storage-kit/remote-storage split — a new feature, not a rebase. The PR is also CONFLICTING against the reworked main and its committed dist/bin bundles are stale.

No action salvageable as-is; superseded by #12 + the PURE REMOTE reconcile on main.