[containarium-ci]

For #33: [S9b] Web follow-up: pin CVE ranking order, document serve, exact oversize status, warn on non-loop…

Closes #33

The line above closes the issue when this pull request is merged. The agent reports 4 of 5 checklist items as met (see Acceptance below). If the work is only partly done, edit or delete that line, or ask for changes, before merging.

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Four should-level gaps from the PR #28 review. (1) report-view.test.tsx gets a test with an openssl
component whose CVEs are in neither ascending nor descending order; it asserts the DOM order, so a
sort or reverse in the component fails. (2) README.md gets a short section on touchstone serve:
--addr, TOUCHSTONE_ADDR (the flag wins), and that make web-build must run before go build, otherwise
/ returns 404. (3) TestPostScanRejectsOversizedBody now asserts 400 and zero service calls via a
counting wrapper around service.Stub. The 400 comes from reading the generated gateway handler: a
body-read error becomes codes.InvalidArgument. (4) serve() takes an errOut writer, run() passes
os.Stderr, and serve prints a warning when the address is not loopback. localhost and loopback IPs
are exempt; an empty host such as :8080 warns. Tests cover the helper table and serve-level loopback
(no output) versus 0.0.0.0 (warning). Tests were not run: go and npx execution was refused in this
session.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Oversized-body status asserted as 400: the generated gateway handler
   (gen/go/touchstone/v1/scan.pb.gw.go) maps a body-decode error to InvalidArgument. Not run; CI
   must confirm.
2. serve() now takes an errOut writer; run() passes os.Stderr, so the warning goes to stderr as the
   issue asks and tests can capture it.
3. Non-loopback check: host 'localhost' and loopback IPs are exempt without DNS lookup; an empty
   host such as ':8080' warns because it binds every interface.
4. Serve-level warning test binds 0.0.0.0:0 for real; the pure helper table covers ':8080',
   '[::]:8080' and hostnames without binding.
5. Commit not created: git commit was refused by the approval gate in this session; the six changed
   files are staged on agent/issue-33 (created from main at 7b3d1ef).
6. Tests not run: go vet, go test, npx tsc and npx vitest were all refused by the approval gate, so
   every change was checked by reading only.
7. No package.json, vitest/tsconfig, Makefile or component file names changed; report-view.test.tsx
   gained one test and one import.

Changes

• README.md — 56 lines
• cmd/touchstone/main.go — 87 lines
• cmd/touchstone/serve.go — 119 lines
• cmd/touchstone/serve_test.go — 191 lines
• internal/server/server_test.go — 100 lines
• web/src/components/report-view.test.tsx — 154 lines

6 file(s) in all.

Acceptance, from the issue

• ✅ met The ranking test fails if the component sorts or reverses the CVE list. — the agent says: Test uses a non-sorted, non-reversed CVE order and asserts DOM order; not run here.
• ✅ met `README.md` documents `--addr`, `TOUCHSTONE_ADDR` and the `make web-build` order. — the agent says: README section documents --addr, TOUCHSTONE_ADDR and the make web-build order.
• ✅ met The oversized-body test asserts the exact status and a zero service-call count. — the agent says: Asserts exact 400 and zero service calls via a counting wrapper; not run here.
• ✅ met A non-loopback address prints a warning to stderr; a loopback address prints nothing; both are tested. — the agent says: serve warns on stderr for non-loopback; helper table and serve-level tests added; not run here.
• ❌ not met `go vet ./...`, `go test ./...`, `npx tsc --noEmit` and `npx vitest run` pass. — the agent says: go vet, go test, npx tsc and npx vitest were not run; execution was refused.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Tests, as reported by the agent: not_run

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run dc0bbf20). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.