fix(ci): stage non-root-readable local inputs - #2514
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 320c02bc70
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| target = pathlib.Path('nightly-artifacts/failure-diagnostics/local-compose-start-preflight.json') | ||
| target.parent.mkdir(parents=True, exist_ok=True) | ||
| target.write_text( |
There was a problem hiding this comment.
The probe writes failure-diagnostics/local-compose-start-preflight.json unconditionally, including after every successful startup. The entire nightly-artifacts/ tree is subsequently uploaded, but the publish job omits this path from its allowed set and requires files == allowed, so every otherwise successful run on main will fail with unexpected publication artifacts instead of creating the nightly prerelease. Either emit this receipt only on failure or add it to the validated publication contract, with a source-contract assertion covering the successful branch.
AGENTS.md reference: AGENTS.md:L78-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 090b9e6873
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| failed = collective['status'] != 'passed' | ||
| for service in services if not failed else (): |
There was a problem hiding this comment.
When the collective up -d command returns nonzero—the failure case this probe is intended to diagnose—failed becomes true and this conditional iterable is empty, so the receipt always contains services: []; because the captured stderr is also discarded, an unclassified failure provides no indication of the first failing service. Run the bounded per-service/status diagnostics on the failure branch rather than only after collective startup succeeds.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d032680e40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for service in CORE_SERVICES: | ||
| _run( | ||
| command + ["start", service], |
There was a problem hiding this comment.
On every fresh reset, create leaves all core containers stopped, but this loop follows the alphabetical CORE_SERVICES order, starting analytics before its required healthy db and starting db before its required healthy vector (docker-compose.yml lines 323-326 and 376-378). The official docker compose start reference describes it as starting existing containers; unlike dependency-aware up, these calls do not wait for service_healthy prerequisites, so dependent processes can fail or restart and _wait_ready can time out. Start services in dependency tiers and wait at each health boundary, with an observable ordering/readiness test rather than only the added source-string assertions.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91154078c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| started = True | ||
| _run( | ||
| command + ["up", "-d", *CORE_SERVICES], | ||
| command + ["create", "--force-recreate", "--pull=policy", *CORE_SERVICES], |
There was a problem hiding this comment.
The official docker compose create options limit --pull to always, missing, never, or build; policy is the CLI's default sentinel, not a valid explicitly supplied value. Consequently every start or reset fails at this first create command before starting the stack, and the Studio create repeats the same invalid argument. Omit the flag or select a supported policy, and exercise the pinned CLI instead of asserting only that this string exists.
AGENTS.md reference: AGENTS.md:L78-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c98bb1d755
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| _wait_ready(command, values, required=CORE_REQUIRED) | ||
| _run( | ||
| command + ["up", "-d", "studio"], | ||
| command + ["create", "--force-recreate", "--pull=policy", "studio"], |
There was a problem hiding this comment.
When startup reaches this command, studio still depends on analytics, which transitively depends on db and vector; Compose includes dependencies during creation, and its documented --force-recreate behavior is to “recreate containers even if their configuration and image haven't changed” (Docker Compose create reference). This therefore replaces already-ready core containers, while the following start studio does not restart those dependencies, causing the final _wait_ready to time out after an otherwise successful core phase. Create Studio without recreating its dependencies or include it in the initial creation set.
AGENTS.md reference: AGENTS.md:L78-L80
Useful? React with 👍 / 👎.
| if result.returncode == 0: | ||
| record = {'service': service, 'status': 'passed', 'failure_class': 'none'} | ||
| else: | ||
| record['failure_class'] = classify(result.stderr) |
There was a problem hiding this comment.
On the collective-failure recovery path, a zero exit from docker compose start only confirms that Compose issued the start request—the command is documented as starting existing containers (Docker Compose start reference); a container with a broken entrypoint can exit immediately afterward. The newly added recovery branch is fresh evidence beyond the earlier empty-list issue: it now populates services, but marks each service passed without any bounded ps, state, or health readback, so the receipt can still classify the actual failing service as successful.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
| [*command_prefix, 'down', '--volumes', '--remove-orphans'], | ||
| capture_output=True, | ||
| text=True, | ||
| timeout=120, |
There was a problem hiding this comment.
When the collective startup fails and Docker teardown itself exceeds 120 seconds—the degraded-daemon scenario this diagnostic path is meant to handle—subprocess.run raises TimeoutExpired here. Because this cleanup call is outside the following exception handling, the step exits before writing local-compose-start-preflight.json or running the lifecycle reset, losing the bounded diagnostic receipt instead of classifying the cleanup failure. Catch teardown timeouts and OS errors and retain a fixed failure class before continuing or failing closed.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
| GENERATOR_VERSION = "local-stack-v1" | ||
| COMPOSE_START_TIMEOUT_SECONDS = 600 | ||
| COMPOSE_START_RETRIES = 2 | ||
| COMPOSE_SERVICE_START_TIMEOUT_SECONDS = 180 |
There was a problem hiding this comment.
When an individual Compose start hits two transient runner or daemon failures, this value gives _run only two total attempts—one initial attempt and one retry—before aborting the reset. The previous combined startup used COMPOSE_START_RETRIES = 2, and the operations guide still states that Core and Studio starts retry twice after failures, so splitting startup silently reduces the documented resilience exactly on the new per-service error path. Set this retry count to two or otherwise preserve three total attempts.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a0ea3c921
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| _run( | ||
| command + ["start", service], | ||
| timeout=COMPOSE_SERVICE_START_TIMEOUT_SECONDS, | ||
| error_code=f"compose_core_start_{service}", |
There was a problem hiding this comment.
When an individual service start reaches the 180-second timeout, _run handles TimeoutExpired by emitting the generic docker_timeout code instead of the supplied compose_core_start_<service> code. Consequently the reset receipt loses the identity of the service that timed out—the primary diagnostic benefit of splitting startup into per-service commands. Include the stage/service identifier in the timeout error code as well.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4135ebd1af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ], | ||
| }) | ||
| records.sort(key=lambda item: item['service']) | ||
| pathlib.Path('nightly-artifacts/failure-diagnostics/local-compose-runtime-diagnostics.json').write_text( |
There was a problem hiding this comment.
Separate from the already-reported startup receipt, this new if: always() step independently writes failure-diagnostics/local-compose-runtime-diagnostics.json on every successful run, and the whole nightly-artifacts/ directory is uploaded. The publish validator's exact allowed set omits this path, so successful main runs still fail with unexpected publication artifacts; emit it only for failures or add and validate it in the publication contract, including a successful-branch assertion rather than the current source-token check.
AGENTS.md reference: AGENTS.md:L78-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dcbc416ee2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 'oom_killed': state.get('OOMKilled') is True, | ||
| 'restart_count': payload.get('RestartCount') if isinstance(payload.get('RestartCount'), int) and payload.get('RestartCount') >= 0 else None, | ||
| 'log_failure_class': classify(logs), | ||
| 'health': health.get('Status') if health.get('Status') in allowed_health else 'unknown', |
There was a problem hiding this comment.
In the new Capture bounded Compose runtime diagnostics step, services without a Compose health check—such as kong, rest, meta, and functions—have no State.Health object, so health.get('Status') returns None and this expression records unknown. The declared none state is therefore unreachable for these services, causing successful and failed runs to contain misleading health readbacks; explicitly map an absent Health object to none.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7d5e2f908
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| check=False, | ||
| ) | ||
| database_presence = { | ||
| 'status': 'passed' if presence.returncode == 0 and presence.stdout.strip() in {'supabase_db_present', 'supabase_db_missing'} else 'failed', |
There was a problem hiding this comment.
When the diagnostic query succeeds but returns supabase_db_missing, this condition still records the presence check as status: passed. A failed reset caused by the missing _supabase database will therefore produce contradictory evidence and can send operators away from the actual bootstrap failure; only supabase_db_present should make this check pass.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
twoimo
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fdc0a4d7f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| except (LocalStackError, OSError, ValueError): | ||
| pass |
There was a problem hiding this comment.
If docker rm -f times out or returns nonzero, this handler silently continues after leaving the raw helper container attached to both init volumes. A later start or reset then fails in _assert_project_volumes, because that helper has no Compose project/service labels, while teardown cannot remove its referenced volumes; the workflow's own reset cleanup likewise removes volume consumers before deleting volumes. Retry and read back helper removal, or fail the current operation rather than reporting a successful, non-idempotent start.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
twoimo
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 865ad923dc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| *command_prefix, 'up', '-d', '--pull=never', | ||
| *services, |
There was a problem hiding this comment.
On every fresh hosted run, this up executes after the direct Compose create preflight but before _stage_input_files is ever invoked, so the new named volumes do not contain the generated kong.yml, Vector config, Edge Function source, pooler config, or repository SQL staged by the real lifecycle. Services can therefore exit or restart because paths such as /home/kong/temp.yml and /etc/vector/vector.yml are absent, while detached up and the subsequent start commands may still return zero; the resulting preflight diagnoses its own incomplete setup and can report broken services as passed rather than testing the lifecycle configuration.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59b72c0e9d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| container_id = None | ||
| if isinstance(payload, dict): | ||
| container_id = payload.get('Id') | ||
| if isinstance(container_id, str) and re.fullmatch(r'[0-9a-f]{12,64}', container_id): |
There was a problem hiding this comment.
In the Capture bounded Compose runtime diagnostics step, any normal run that discovers a Kong or Supavisor container with a valid Id reaches re.fullmatch, but this embedded script never imports re. It therefore raises NameError before writing the diagnostics receipt; because Python is the final command, set +e does not prevent the step from returning nonzero and failing the nightly job. Add the import and cover the observable populated-container branch rather than only checking source tokens.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
| runtime_input_checks[service]['file'] = ( | ||
| 'passed' if probe.returncode == 0 | ||
| else 'missing' if probe.returncode == 1 | ||
| else 'unknown' |
There was a problem hiding this comment.
When a preserved startup failure leaves Kong or Supavisor in the created or exited state, docker exec cannot run the probe because exec commands only run while the container's primary process is running (Docker exec reference); a daemon-side failure can return 1, which this mapping reports as missing even though test -r never executed. The same mapping is repeated for the database init-file probes, so gate these checks on a running container or otherwise distinguish an exec failure from a genuine unreadable path.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d9f8a4650
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| except subprocess.TimeoutExpired: | ||
| database_bootstrap['failure_class'] = 'timeout' | ||
| database_presence['status'] = 'unavailable' | ||
| database_init_files['status'] = 'unavailable' |
There was a problem hiding this comment.
In the Capture bounded Compose runtime diagnostics step, if the database-presence and init-file probes complete but the final _analytics query times out, this shared exception handler rewrites both completed checks to unavailable while leaving their successful result, exit_code, and per-file values intact. The resulting receipt is contradictory and discards useful failure evidence; isolate each probe's exception handling so only the probe that actually timed out is marked unavailable.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 71f5ee4aec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| database_bootstrap = { | ||
| 'status': 'passed' if result.returncode == 0 and result.stdout.strip() == 'analytics_schema_present' else 'failed', | ||
| 'result': result.stdout.strip() if result.stdout.strip() in {'analytics_schema_present', 'analytics_schema_missing'} else 'unknown', | ||
| 'failure_class': classify(result.stderr), |
There was a problem hiding this comment.
When _supabase exists but the query returns analytics_schema_missing with exit code 0, status is correctly recorded as failed, but classifying the empty stderr produces failure_class: none. This makes the bootstrap receipt internally contradictory during the exact incomplete-initialization case it is meant to diagnose; derive a fixed failure class from the recognized missing-schema result before falling back to stderr classification.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a9f0a755ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 'db', 'analytics', 'auth', 'functions', 'imgproxy', 'kong', 'mail', | ||
| 'meta', 'realtime', 'rest', 'storage', 'supavisor', 'vector', |
There was a problem hiding this comment.
In the checked Probe Compose service startup recovery branch, a failed collective startup followed by a successful fresh create leaves all services stopped, but this order starts db before vector is healthy and then starts analytics before db is healthy, despite the service_healthy dependencies in backend/supabase/docker-compose.yml. The official docker compose start reference describes this command as starting existing containers; it does not provide up's dependency-health orchestration. The diagnostic can therefore induce a new dependency failure and blame db or analytics rather than reveal the original failing service; start in dependency tiers and read back health between tiers.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9cf535599b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ] | ||
| volume_args: list[str] = [] | ||
| for suffix, path in volume_paths.items(): | ||
| volume_args.extend(("-v", f"{project}-{suffix}:{path}:Z")) |
There was a problem hiding this comment.
On SELinux-enforcing hosts, the service containers are created before this helper, and Docker's Z option applies a private, unshared SELinux label to the mounted content (Docker SELinux mount documentation). The helper therefore relabels all six volumes away from the labels assigned to the already-created service containers; removing the helper does not restore those labels, so subsequent starts can fail with permission errors for Kong, Vector, Functions, Supavisor, or database initialization. Do not privately relabel these named volumes in the helper (or use a shared/reapplied label), and exercise the enforcing-SELinux startup branch rather than relying only on source-token assertions.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
| except (OSError, subprocess.SubprocessError): | ||
| logs = '' |
There was a problem hiding this comment.
When docker logs fails or times out during the degraded-daemon and failed-container scenarios this diagnostic step is meant to investigate, this handler substitutes an empty string; classify('') then records log_failure_class: none. The receipt therefore asserts that no log failure was detected when logs were actually unavailable, hiding the probe failure from operators. Record a fixed unavailable, timeout, or equivalent class for this exception path and cover the observable error branch.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19fe208370
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| except (OSError, subprocess.SubprocessError): | ||
| ids = [] |
There was a problem hiding this comment.
When docker ps fails or times out during a degraded-daemon or failed-startup run, this handler converts the probe failure into ids = [], so the receipt is indistinguishable from a legitimately empty project and contains neither containers nor a fixed discovery failure class. Record the bounded probe failure explicitly instead of silently reporting an empty readback.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
| 'entrypoint_class': ( | ||
| 'limits_wrapper' | ||
| if (payload.get('Config') or {}).get('Entrypoint') == ['/app/limits.sh'] | ||
| else 'image_default' |
There was a problem hiding this comment.
For every container whose entrypoint is not exactly ['/app/limits.sh'], this fallback records image_default, but Kong always has an explicit Compose entrypoint override in backend/supabase/docker-compose.yml. Its runtime receipt therefore reports a false entrypoint classification on every populated run; either scope this evidence to Supavisor or distinguish overridden and unknown entrypoints rather than treating every alternative as the image default.
AGENTS.md reference: AGENTS.md:L80-L80
Useful? React with 👍 / 👎.
1 participant
Summary
create --pull=neverpathRoot-cause evidence
Run 31543163450 proved the first hosted failure was database initialization, not image or container admission: the preserved database container had both nested SQL paths present, but the bounded readback reported
supabase_db_missingand its fixed log class wasdatabase_missing. The generated checkout inputs are mode0600; the pinned image executesmigrate.shaspostgres, so Linux bind mounts were unreadable to the migration process. Follow-up run 31545781442 proved the database fix:supabase_db_presentandanalytics_schema_presentboth passed. Runs 31547193734 through 31556014185 proved all core services and staged files except Supavisor were healthy; Supavisor alone restarted with fixedoperation_not_permitted. Runtime evidence showed the limits wrapper was active, and the pinned Supavisor runtime enables clustering for any non-emptyCLUSTER_POSTGRESvalue; local reproductions also showed the inheritedERL_AFLAGS=-proto_dist inet_tcpwas unnecessary for this single-node lane. The overlay now removes both inherited flags and uses no distribution setup.Fix evidence
All generated local inputs remain
0600in the checkout and are never made readable there. A network-isolated helper copies the fixed Kong, Vector, Pooler, Functions, and database inputs into project-scoped Docker volumes, chmods only those disposable volume copies to0644, waits for exit, and is removed before service startup. The Compose model and input manifest record the volume mounts; cleanup removes and verifies all nine exact project volume names. A local pinned-image proof confirmed all staged files are readable as an unprivileged user, and local Supavisor runs with wrapper/no-cluster/no-distribution settings reached HTTP startup.Verification
python3 -m unittest backend.supabase.tests.test_local_compose_inputs backend.supabase.tests.test_local_function_runtime_contract backend.supabase.tests.test_local_migration_contract backend.supabase.tests.test_local_seed_receipt_contract: 35 passedbun test tests-unit/nightly-regression-workflow.test.ts: 14 passed / 258 expect callsHosted acceptance is rerun from this head; no publication or release claim is made until that run completes successfully.