vibed-infra 0.13.0 → 0.14.0

package/README.md

@@ -68,7 +68,7 @@ See [`skills/infra-update-agent/SKILL.md`](skills/infra-update-agent/SKILL.md).
 | `templates/persist-logs/` | Shipper install + persist sidecar |
 | `templates/monitor/` | Machine-wide `monitor-vibed.sh` |
 | `lib/persistlog/` | Python append / seal / replay |
-| `skills/` | system-gateway, agent-vps-prep, infra-update-agent, infra-cicd, infra-packager, persist-logs, dns-configure |
+| `skills/` | system-gateway, agent-vps-prep, infra-update-agent, infra-cicd, infra-e2e-cicd, infra-packager, persist-logs, dns-configure |
 
 ## Environment
 

package/github/workflows/docker-build-reusable.yml

@@ -1,4 +1,5 @@
 # Reusable GHCR docker build — one image per workflow_call.
+# Keep in sync with .github/workflows/docker-build-reusable.yml (GitHub uses .github/).
 #
 # Caller (repeat per image or use a matrix in the caller workflow):
 #
@@ -37,6 +38,10 @@ on:
         required: false
         type: boolean
         default: true
+      build-args:
+        required: false
+        type: string
+        default: BUILD_PROFILE=production
     secrets:
       VIBED_WEBHOOK_SECRET:
         required: false
@@ -75,6 +80,9 @@ jobs:
           file: ${{ inputs.dockerfile }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          build-args: ${{ inputs.build-args }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.source=https://github.com/${{ github.repository }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibed-infra",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Product-agnostic VPS packager: wget install, Docker Compose, TLS/nginx, auto-update",
   "license": "MIT",
   "repository": {

package/skills/infra-cicd/SKILL.md

@@ -41,6 +41,8 @@ On the default branch, the reusable workflow mints a GitHub Actions OIDC JWT (au
 2. Build/push images to GHCR (reusable workflow notifies the VPS; requires `id-token: write`).
 3. Optional job: `test-dist.sh --profile api` on a Docker-enabled runner.
 
+**Product e2e (Playwright, temp DB, human-action harnesses):** see [`infra-e2e-cicd`](../infra-e2e-cicd/SKILL.md). vibed-infra CI validates the packager; product repos add browser e2e for app critical paths.
+
 ## Checklist
 
 - [ ] Four YAML templates under `templates/` (`gateway.publicIp` / `tlsEmail` / `sites[]` set for production)

package/skills/infra-e2e-cicd/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: infra-e2e-cicd
+description: >-
+  E2E CI/CD for vibed-infra products: GHCR build/tag (UI/API/nodes), OIDC
+  auto-update, Docker pull-size optimization, Playwright critical paths, temp DB,
+  CI-only human-action harnesses. Use when setting up product GitHub Actions
+  or browser e2e tests.
+---
+
+# E2E CI/CD for vibed-infra products
+
+Best practices for product repos that use the infra packager. An agent should read this skill after [`infra-packager`](../infra-packager/SKILL.md) and apply the reference templates to the product repo.
+
+## Separation of concerns
+
+| Layer | What it proves | Where |
+|-------|----------------|-------|
+| **vibed-infra CI** | Install scripts, named volumes, OIDC webhook, multi-app gateway | This repo — `npm test`, `test:dist`, `test:e2e-multi` |
+| **Product CI** | App critical paths, Playwright UI flows, temp DB, human-action harnesses | Product repo — see [reference/product-ci-workflow.yml](reference/product-ci-workflow.yml) |
+
+vibed-infra CI does **not** run Playwright. Products add browser e2e for their own critical paths.
+
+## Product CI job graph
+
+```
+validate (package drift + unit tests)
+  → build-api / build-ui / build-nodes (GHCR push + OIDC notify)
+  → e2e-playwright (temp DB, VIBED_E2E_HARNESS=1)
+  → harness-absence check (production-profile image returns 404 on /__e2e__/*)
+```
+
+On default-branch push, each GHCR build job notifies the VPS via OIDC (see [`infra-update-agent`](../infra-update-agent/SKILL.md)). Tags: `:main`, `main-<sha>`, semver on release tag.
+
+## Critical paths
+
+1. **Identify** user journeys that must never break: sign-in, core CRUD, checkout, wallet sign, etc.
+2. **One Playwright spec per journey** — keep specs focused; use smoke vs full suite tags (`@smoke`).
+3. **Map selectors** to stable `data-testid` attributes (see [reference/playwright-ui.md](reference/playwright-ui.md)).
+4. **Never point e2e at prod or VPS DB** — always use a temp database per CI job.
+
+## Temp DB
+
+- **Postgres**: GitHub Actions `services:` block or `docker compose` service; unique database name per job (`e2e_${{ github.run_id }}`).
+- **SQLite**: tmpfile path in env; delete on job end.
+- Run migrations **before** Playwright starts (`npx prisma migrate`, `alembic upgrade`, etc.).
+- Seed minimal fixtures in the e2e setup hook, not in production migrations.
+
+## VPS vs CI images
+
+| | VPS (production) | CI (e2e) |
+|---|------------------|----------|
+| Tag | `:main` from GHCR | `:local` or `:main-<sha>` built in job |
+| `BUILD_PROFILE` | `production` (default in reusable workflow) | `e2e` only in e2e compose |
+| `VIBED_E2E_HARNESS` | unset | `1` |
+| Harness routes | **404 / absent** | available for simulators |
+
+Production images pushed to GHCR use `BUILD_PROFILE=production` by default (reusable workflow). Harness code lives under `e2e/` and is never imported by the production server entrypoint.
+
+## Reference docs
+
+| Topic | File |
+|-------|------|
+| Full product CI workflow | [reference/product-ci-workflow.yml](reference/product-ci-workflow.yml) |
+| Docker pull-size optimization | [reference/docker-optimization.md](reference/docker-optimization.md) |
+| Playwright-friendly UI + config | [reference/playwright-ui.md](reference/playwright-ui.md) |
+| Passkey / wallet / captcha harnesses | [reference/human-harnesses.md](reference/human-harnesses.md) |
+
+## GHCR build (one job per image)
+
+Use the reusable workflow from vibed-infra (see [`infra-cicd`](../infra-cicd/SKILL.md)):
+
+```yaml
+build-api:
+  uses: naiemk/vibed-infra/.github/workflows/docker-build-reusable.yml@main
+  permissions:
+    contents: read
+    packages: write
+    id-token: write
+  with:
+    dockerfile: app/api/Dockerfile
+    image: ghcr.io/${{ github.repository_owner }}/my-api
+    build-args: BUILD_PROFILE=production
+```
+
+Repeat for UI and nodes/worker images. Image names must match `*-config.yaml` and include `ghcr.io/{owner}/…` so OIDC notify matches the update-agent registry.
+
+## Checklist
+
+- [ ] Critical paths listed and covered by Playwright specs
+- [ ] `./package.sh` + `git diff --exit-code dist` in CI validate job
+- [ ] GHCR jobs for api, ui, nodes with `id-token: write`
+- [ ] Dockerfiles follow [docker-optimization.md](reference/docker-optimization.md) (pull size first)
+- [ ] UI uses `data-testid` on interactive elements
+- [ ] E2e uses temp DB; migrations run before tests
+- [ ] Harness code only under `e2e/`; production build excludes it
+- [ ] CI asserts `/__e2e__/health` returns 404 on production-profile image
+- [ ] `VIBED_E2E_HARNESS` never set in VPS `.env` or `dist/` templates
+
+## Agent workflow
+
+1. Read `infra-packager` → wire templates + commit `dist/`.
+2. Apply [product-ci-workflow.yml](reference/product-ci-workflow.yml) to `.github/workflows/ci.yml`.
+3. Optimize Dockerfiles per [docker-optimization.md](reference/docker-optimization.md).
+4. Add Playwright config + specs per [playwright-ui.md](reference/playwright-ui.md).
+5. Add harness stubs from [human-harnesses.md](reference/human-harnesses.md) under `e2e/` only.
+6. Add prod-image harness-absence check to CI.
+7. Wire GHCR matrix with `id-token: write` per `infra-update-agent`.

package/skills/infra-e2e-cicd/reference/docker-optimization.md

@@ -0,0 +1,124 @@
+# Docker build optimization (pull size first, then build speed)
+
+Every push to `main` triggers a digest-gated `docker pull` on the VPS. Optimize layers so **most pulls transfer minimal bytes**, then speed up CI builds.
+
+## Priority rules
+
+| Priority | Rule |
+|----------|------|
+| 1 | **Multi-stage**: slim runtime (`alpine`, `distroless`); compilers and devDeps stay in builder stage |
+| 2 | **Layer order**: base → OS packages → lockfiles → install deps → **source last** |
+| 3 | **`.dockerignore`**: exclude `node_modules`, `.git`, `e2e/`, `tests/`, `*.md`, `.env*` |
+| 4 | **Pin base image** by digest in production Dockerfiles |
+| 5 | **Avoid busting dep layers**: copy `package-lock.json` / `requirements.txt` before `COPY .` |
+| 6 | **CI-only** (secondary): BuildKit cache mounts + GHA cache in reusable workflow |
+
+GHA cache (`cache-from` / `cache-to: type=gha`) speeds CI rebuilds. It does **not** change what the VPS pulls — layer ordering and multi-stage builds do.
+
+## `.dockerignore` (product root)
+
+```
+.git
+node_modules
+e2e
+tests
+**/*.md
+.env*
+dist
+.github
+```
+
+## API — before (pull-unfriendly)
+
+```dockerfile
+FROM python:3.12-alpine
+WORKDIR /app
+COPY . .
+RUN pip install -r requirements.txt
+CMD ["python", "server.py"]
+```
+
+Every source change busts the dependency layer; full tree copied early.
+
+## API — after (pull-friendly)
+
+```dockerfile
+FROM python:3.12-alpine@sha256:… AS runtime
+RUN apk add --no-cache wget \
+  && adduser -D -u 1000 app
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY server.py .
+ARG BUILD_PROFILE=production
+ENV BUILD_PROFILE=$BUILD_PROFILE
+RUN mkdir -p /data /config && chown -R app:app /data /config /app
+USER 1000
+EXPOSE 8080
+CMD ["python3", "server.py"]
+```
+
+Lockfile copied first → dependency layer cached across commits. Only `server.py` (and siblings) bust on app changes.
+
+## UI — static site with nginx (multi-stage)
+
+```dockerfile
+# builder — not shipped to VPS
+FROM node:22-alpine@sha256:… AS builder
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+ARG BUILD_PROFILE=production
+ENV VITE_BUILD_PROFILE=$BUILD_PROFILE
+RUN npm run build
+
+# runtime — minimal pull
+FROM nginx:1.27-alpine@sha256:…
+COPY --from=builder /src/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
+```
+
+The VPS pulls only the nginx layer plus changed static assets — not Node, `node_modules`, or source.
+
+## Worker / nodes
+
+Same rules as API. Keep worker images separate from API so a UI change does not force an API pull (and vice versa).
+
+## `BUILD_PROFILE` in Dockerfile
+
+Products gate harness imports on build arg:
+
+```dockerfile
+ARG BUILD_PROFILE=production
+ENV BUILD_PROFILE=$BUILD_PROFILE
+```
+
+- GHCR pushes (VPS): `BUILD_PROFILE=production` (reusable workflow default).
+- Local e2e compose: `BUILD_PROFILE=e2e` only in `docker-compose.e2e.yml`.
+
+Never set `BUILD_PROFILE=e2e` in VPS install `.env` or production GHCR workflow.
+
+## Reusable workflow (CI build speed)
+
+The vibed-infra reusable workflow passes:
+
+```yaml
+build-args: BUILD_PROFILE=production
+cache-from: type=gha
+cache-to: type=gha,mode=max
+```
+
+Products can override `build-args` per job if needed.
+
+## Verify pull efficiency
+
+On the VPS after a small code change:
+
+```bash
+docker pull ghcr.io/owner/my-api:main
+# Should report "Already exists" for most layers; only changed layers download
+```
+
+Use `docker history ghcr.io/owner/my-api:main` to confirm large layers (deps, base) are stable across commits.

package/skills/infra-e2e-cicd/reference/human-harnesses.md

@@ -0,0 +1,183 @@
+# CI human-action harnesses (passkeys, wallet, captcha)
+
+Simulate human interactions in Playwright CI only. **Harness code must be completely unavailable on VPS production builds.**
+
+## Three-layer VPS exclusion contract
+
+1. **Source layout** — all harness code under `e2e/` or `test/harness/`; never in `app/` production paths imported by the server entrypoint.
+2. **Build gate** — `BUILD_PROFILE=production` excludes harness modules; GHCR images use production profile only (reusable workflow default).
+3. **Runtime gate** — `VIBED_E2E_HARNESS` unset on VPS; CI compose sets `VIBED_E2E_HARNESS=1`.
+
+## Verification (product CI)
+
+After building a production-profile image, assert harness routes are absent:
+
+```bash
+cid=$(docker run -d -p 18080:8080 prod-api:ci)
+trap "docker rm -f $cid" EXIT
+sleep 2
+code=$(curl -sf -o /dev/null -w "%{http_code}" http://localhost:18080/__e2e__/health || echo "000")
+test "$code" = "404" || test "$code" = "000" || (echo "harness leaked: HTTP $code" && exit 1)
+```
+
+Never add `VIBED_E2E_HARNESS`, `E2E_CAPTCHA_SECRET`, or harness URLs to VPS `.env` templates or committed `dist/`.
+
+---
+
+## Passkeys / WebAuthn
+
+**CI approach:** Playwright CDP virtual authenticator; optional test-only registration endpoint when harness is on.
+
+**VPS exclusion:** Route module in `e2e/harness/webauthn_routes.py` (or equivalent); imported only when `BUILD_PROFILE=e2e` or dynamic import gated on `VIBED_E2E_HARNESS`.
+
+### Playwright virtual authenticator stub (`e2e/harness/webauthn.ts`)
+
+```typescript
+import { type BrowserContext, type CDPSession } from "@playwright/test";
+
+export async function enableVirtualAuthenticator(context: BrowserContext) {
+  const page = context.pages()[0] ?? await context.newPage();
+  const client = await context.newCDPSession(page);
+  await client.send("WebAuthn.enable");
+  const { authenticatorId } = await client.send("WebAuthn.addVirtualAuthenticator", {
+    options: {
+      protocol: "ctap2",
+      transport: "internal",
+      hasResidentKey: true,
+      hasUserVerification: true,
+      isUserVerified: true,
+    },
+  });
+  return { client, authenticatorId };
+}
+```
+
+### Test-only server route stub (`e2e/harness/webauthn_routes.py`)
+
+```python
+# Import ONLY from e2e entrypoint when VIBED_E2E_HARNESS=1 — never from prod server.py
+import os
+from flask import Blueprint, jsonify
+
+bp = Blueprint("e2e_webauthn", __name__, url_prefix="/__e2e__/webauthn")
+
+@bp.route("/register", methods=["POST"])
+def register_credential():
+    if os.environ.get("VIBED_E2E_HARNESS") != "1":
+        return jsonify(error="not found"), 404
+    # Return a fixed test credential payload for the app's WebAuthn verify step
+    return jsonify({"credentialId": "e2e-test-credential", "publicKey": "…"})
+```
+
+Wire `bp` in an `e2e/server_extensions.py` that production `server.py` never imports.
+
+---
+
+## MetaMask / wallet signing
+
+**CI approach:** Inject `window.ethereum` mock via Playwright `addInitScript`; optionally use [Synpress](https://github.com/Synthetixio/synpress) for extension-based flows in CI only.
+
+**VPS exclusion:** Mock script lives in `e2e/harness/`; never bundled in production UI build.
+
+### Wallet mock stub (`e2e/harness/ethereum-mock.ts`)
+
+```typescript
+import { type Page } from "@playwright/test";
+
+const TEST_ADDRESS = "0x70997970C51812dc3A010C7d01b50e0d17dc79C8";
+
+export async function injectEthereumMock(page: Page) {
+  await page.addInitScript(({ address }) => {
+    (window as unknown as { ethereum?: unknown }).ethereum = {
+      isMetaMask: true,
+      selectedAddress: address,
+      request: async ({ method }: { method: string }) => {
+        if (method === "eth_requestAccounts") return [address];
+        if (method === "eth_accounts") return [address];
+        if (method === "personal_sign") return "0x" + "ab".repeat(32);
+        if (method === "eth_chainId") return "0x1";
+        throw new Error(`unsupported: ${method}`);
+      },
+    };
+  }, { address: TEST_ADDRESS });
+}
+```
+
+### Example spec usage
+
+```typescript
+test("wallet connect and sign @smoke", async ({ page }) => {
+  await injectEthereumMock(page);
+  await page.goto("/connect");
+  await page.getByTestId("connect-wallet").click();
+  await expect(page.getByTestId("wallet-address")).toContainText("0x7099");
+});
+```
+
+Do not ship MetaMask extension or mock provider in production Docker images.
+
+---
+
+## Captcha
+
+**CI approach:** Server accepts `X-E2E-Captcha-Bypass: $E2E_CAPTCHA_SECRET` when harness env is set; Playwright sets header globally or per request.
+
+**VPS exclusion:** Bypass handler in separate module; eliminated from production build via `BUILD_PROFILE=production`.
+
+### Server bypass stub (`e2e/harness/captcha_bypass.py`)
+
+```python
+import os
+
+def captcha_verified(request) -> bool:
+    if os.environ.get("VIBED_E2E_HARNESS") != "1":
+        return False  # production path uses real captcha provider only
+    secret = os.environ.get("E2E_CAPTCHA_SECRET", "")
+    return secret and request.headers.get("X-E2E-Captcha-Bypass") == secret
+```
+
+Use in your captcha middleware:
+
+```python
+if captcha_verified(request):
+    return  # skip provider verify in CI only
+# … real hCaptcha / Turnstile verify …
+```
+
+### Playwright global header (`playwright.config.ts`)
+
+```typescript
+use: {
+  extraHTTPHeaders: process.env.VIBED_E2E_HARNESS === "1"
+    ? { "X-E2E-Captcha-Bypass": process.env.E2E_CAPTCHA_SECRET ?? "" }
+    : {},
+},
+```
+
+Set `E2E_CAPTCHA_SECRET` only in CI secrets or e2e compose — never on VPS.
+
+---
+
+## Harness health endpoint (CI only)
+
+Optional liveness for e2e compose debugging:
+
+```python
+@bp.route("/health")
+def harness_health():
+    if os.environ.get("VIBED_E2E_HARNESS") != "1":
+        return "", 404
+    return jsonify(ok=True)
+```
+
+Production profile must return **404** for `/__e2e__/health` — verified in the `harness-absence` CI job.
+
+## Summary
+
+| Harness | CI simulator | VPS must not have |
+|---------|--------------|-------------------|
+| Passkeys | CDP virtual authenticator + optional `/__e2e__/webauthn/*` | Virtual auth routes, test credentials |
+| Wallet | `window.ethereum` mock in Playwright | Extension, mock provider in bundle |
+| Captcha | `X-E2E-Captcha-Bypass` header + env secret | Bypass env vars, bypass middleware in prod build |
+
+Products wire app-specific flows on top of these stubs; vibed-infra documents the pattern, not a shared npm package.

package/skills/infra-e2e-cicd/reference/playwright-ui.md

@@ -0,0 +1,122 @@
+# Playwright-friendly UI and CI setup
+
+Design the product UI so Playwright tests are stable, fast, and maintainable.
+
+## UI design rules
+
+1. **`data-testid` on interactive elements** — prefer over CSS classes, auto-generated IDs, or visible text that changes with i18n.
+
+```html
+<form id="form" data-testid="note-form">
+  <input data-testid="note-input" … />
+  <button type="submit" data-testid="note-submit">Post</button>
+</form>
+<ul id="list" data-testid="note-list"></ul>
+<p id="status" data-testid="status"></p>
+```
+
+2. **Stable routes** — use predictable URLs for auth and core flows (`/login`, `/dashboard`). Avoid hash-only navigation for critical paths.
+
+3. **Reduce flakiness**
+   - Set `aria-busy="true"` while loading; tests wait for `[aria-busy="false"]`.
+   - Disable animations in e2e: `prefers-reduced-motion: reduce` via test env CSS, or `VIBED_E2E_HARNESS=1` body class.
+   - Avoid `setTimeout`-driven UI; use explicit ready states.
+
+4. **Auth state** — expose login via API or cookie the test can set; do not rely only on `localStorage` without a test hook.
+
+5. **Error surfaces** — use `data-testid="error-message"` so failures are assertable without parsing console logs.
+
+## Playwright config stub (`playwright.config.ts`)
+
+```typescript
+import { defineConfig, devices } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "e2e/specs",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+  reporter: process.env.CI ? [["github"], ["html"]] : "list",
+  use: {
+    baseURL: process.env.PLAYWRIGHT_BASE_URL ?? "http://localhost:3000",
+    trace: "on-first-retry",
+    screenshot: "only-on-failure",
+  },
+  projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
+});
+```
+
+Tag smoke tests: `test("user can post a note @smoke", …)`.
+
+## Example spec stub
+
+```typescript
+import { test, expect } from "@playwright/test";
+
+test("user can post a note @smoke", async ({ page }) => {
+  await page.goto("/");
+  await expect(page.getByTestId("status")).toContainText("Live");
+  await page.getByTestId("note-input").fill("hello e2e");
+  await page.getByTestId("note-submit").click();
+  await expect(page.getByTestId("note-list")).toContainText("hello e2e");
+});
+```
+
+## E2e stack (`docker-compose.e2e.yml` stub)
+
+```yaml
+services:
+  api:
+    image: my-api:local
+    build:
+      context: app/api
+      args:
+        BUILD_PROFILE: e2e
+    environment:
+      VIBED_E2E_HARNESS: "1"
+      E2E_CAPTCHA_SECRET: ci-test-secret
+      DATABASE_URL: postgresql://e2e:e2e@postgres:5432/e2e
+    ports:
+      - "8080:8080"
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  ui:
+    image: my-ui:local
+    ports:
+      - "3000:80"
+    depends_on:
+      - api
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: e2e
+      POSTGRES_PASSWORD: e2e
+      POSTGRES_DB: e2e
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "e2e"]
+      interval: 5s
+      retries: 5
+```
+
+Set `PLAYWRIGHT_BASE_URL=http://localhost:3000` in the Playwright job.
+
+## CI job essentials
+
+```yaml
+- run: npx playwright install --with-deps chromium
+- run: npx playwright test --grep @smoke
+  env:
+    PLAYWRIGHT_BASE_URL: http://localhost:3000
+```
+
+Upload `playwright-report/` as a CI artifact on failure.
+
+## What not to do
+
+- Do not use production GHCR `:main` images for e2e with harness enabled — build `:local` or use `BUILD_PROFILE=e2e`.
+- Do not add test-only routes to production UI bundles without build-profile gating.
+- Do not run Playwright against the VPS or production database.

package/skills/infra-e2e-cicd/reference/product-ci-workflow.yml

@@ -0,0 +1,131 @@
+# Product CI workflow (copy to `.github/workflows/ci.yml`)
+
+Example for a vibed-infra-packaged product with API, UI, and worker images.
+Adjust paths, image names, and e2e commands to match the product repo.
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm test
+      - name: Package drift check
+        run: |
+          ./package.sh
+          git diff --exit-code dist/
+
+  build-api:
+    needs: validate
+    uses: naiemk/vibed-infra/.github/workflows/docker-build-reusable.yml@main
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    with:
+      dockerfile: app/api/Dockerfile
+      image: ghcr.io/${{ github.repository_owner }}/my-api
+      build-args: BUILD_PROFILE=production
+    secrets: inherit
+
+  build-ui:
+    needs: validate
+    uses: naiemk/vibed-infra/.github/workflows/docker-build-reusable.yml@main
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    with:
+      dockerfile: app/ui/Dockerfile
+      image: ghcr.io/${{ github.repository_owner }}/my-ui
+      build-args: BUILD_PROFILE=production
+    secrets: inherit
+
+  build-nodes:
+    needs: validate
+    uses: naiemk/vibed-infra/.github/workflows/docker-build-reusable.yml@main
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    with:
+      dockerfile: app/worker/Dockerfile
+      image: ghcr.io/${{ github.repository_owner }}/my-worker
+      build-args: BUILD_PROFILE=production
+    secrets: inherit
+
+  e2e-playwright:
+    needs: [build-api, build-ui, build-nodes]
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: e2e
+          POSTGRES_PASSWORD: e2e
+          POSTGRES_DB: e2e
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U e2e"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgresql://e2e:e2e@localhost:5432/e2e
+      VIBED_E2E_HARNESS: "1"
+      E2E_CAPTCHA_SECRET: ci-test-secret
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - name: Build local e2e images
+        run: bash scripts/build-images.sh
+      - name: Start e2e stack
+        run: docker compose -f docker-compose.e2e.yml up -d --wait
+      - name: Run DB migrations
+        run: npm run db:migrate
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+      - name: Playwright e2e (critical paths)
+        run: npx playwright test --grep @smoke
+      - name: Teardown
+        if: always()
+        run: docker compose -f docker-compose.e2e.yml down -v
+
+  harness-absence:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build production-profile API image
+        run: docker build --build-arg BUILD_PROFILE=production -t prod-api:ci app/api
+      - name: Assert harness routes absent
+        run: |
+          cid=$(docker run -d -p 18080:8080 prod-api:ci)
+          trap "docker rm -f $cid" EXIT
+          sleep 2
+          code=$(curl -sf -o /dev/null -w "%{http_code}" http://localhost:18080/__e2e__/health || echo "000")
+          test "$code" = "404" || test "$code" = "000" || (echo "harness leaked: HTTP $code" && exit 1)
+```
+
+## Notes
+
+- **PR builds**: GHCR push still runs; OIDC notify only fires on default branch (handled inside reusable workflow).
+- **Disable notify on PR-only builds**: pass `notify: false` to the reusable workflow when `github.event_name == 'pull_request'`.
+- **Matrix alternative**: if GitHub limits reusable workflow calls, inline the build-push steps from [`docker-build-reusable.yml`](../../../.github/workflows/docker-build-reusable.yml) into a matrix job.
+- **Infra dist e2e** (optional): add `bash test-dist.sh --profile api` on a Docker runner to prove install scripts — separate from Playwright.

package/skills/infra-packager/SKILL.md

@@ -36,7 +36,7 @@ exec bash "$PACKAGER/package.sh" --product "$ROOT" --out "$ROOT/dist"
 git add dist && git commit && git push
 ```
 
-6. **CI** — product repo: package drift check + GHCR build (notifies VPS). Packager repo: `npm test`, `oidc-webhook-e2e`, `test-dist.sh`, `npm run test:e2e-multi`.
+6. **CI** — product repo: package drift check + GHCR build (notifies VPS) + Playwright e2e for critical paths ([`infra-e2e-cicd`](../infra-e2e-cicd/SKILL.md)). Packager repo: `npm test`, `oidc-webhook-e2e`, `test-dist.sh`, `npm run test:e2e-multi`.
 
 7. **VPS** — DNS first (paste `dist/DNS-SKILL.md` into AU agent), then wget. Install registers the app with the update-agent so the next GHCR push can pull immediately:
 

package/skills/infra-update-agent/SKILL.md

@@ -63,6 +63,8 @@ jobs:
 
 URLs come from `gateway.publicIp` + `gateway.sites[].host` already in config (`dist/packageconfig.yaml` `webhook.url` / `fallbackUrl`). Disable notify with `notify: false`.
 
+For Playwright e2e, temp DB, and CI-only harnesses on the product side, see [`infra-e2e-cicd`](../infra-e2e-cicd/SKILL.md).
+
 Local curl can send `X-Vibed-Secret` from `tokens/{app}` (compiled hash). Optional `WEBHOOK_SECRET` still works as an override.
 
 ## Tests