Commit Graph

4085 Commits

Author SHA1 Message Date
Sam Julien c641f33d38 docs(shell-docs): retire observability docs 2026-06-19 13:11:05 -07:00
Sam Julien f34eb6e528 docs(shell-docs): refresh intelligence platform docs 2026-06-19 13:11:04 -07:00
Sam Julien 7bb3141024 docs(shell-docs): add copilotkit cli docs 2026-06-19 13:11:04 -07:00
Sam Julien b5c9b0d3c4 docs(shell-docs): instrument intelligence ctas 2026-06-19 13:11:03 -07:00
Tyler Slaton 2688ce4c32 docs(frontends): improve picker and language for non-react frontends (#5586)
## Summary
- Fix frontend selection, logo, and docs navigation behavior in shell
docs
- Update link rewriting, search href generation, SEO redirects, and
sitemap handling for frontend docs paths
- Refresh related docs pages and tests across framework and frontend
routes

## Testing
- Added and updated unit tests for frontend options, link rewriting,
search hrefs, SEO redirects, and framework shell layout
- Added route-level coverage for the llms-mdx endpoint
2026-06-19 12:51:33 -07:00
Jordan Ritter 32d851a290 fix(cvdiag): .NET scrubber redacts URL userinfo (scheme://user:pass@host + colon-less) matching scrubSecrets (M6) 2026-06-19 12:33:06 -07:00
Jordan Ritter a5678c118f fix(cvdiag): Java MessageScrubber parity with scrubSecrets — sk- base64url tails, Bearer \S+, colon-less URL userinfo + size-guard (M6) 2026-06-19 12:33:03 -07:00
Jordan Ritter 0a826bf17f fix(cvdiag): re-stage TS cvdiag emitter from canonical — staged copies were stale (leaked sk-ant-/colon-less URL userinfo + half-missing emit.ts) (M6) 2026-06-19 12:33:00 -07:00
Jordan Ritter c3c7b7908b feat(showcase): cross-env pin-drift probe + Ops routing + bring starters under the image-ref gate 2026-06-19 12:23:23 -07:00
Jordan Ritter 59b18d1bde feat(showcase): prod-staging equivalence gate + verify-prod re-sweep (agent + starter_smoke axes) 2026-06-19 12:23:23 -07:00
Jordan Ritter 43fedfdb55 fix(showcase): fold driver-error/abort + stale dashboard cells to gray (agent + starter axes) 2026-06-19 12:23:23 -07:00
Jordan Ritter a5186c50c2 feat(showcase): ruby promote preflight (service-ref/replicate/resource) + lint-prod starter coverage 2026-06-19 12:23:23 -07:00
Jordan Ritter 73b5c5a798 feat(showcase): tier-ordered dependency-gated cluster promote + lint-prod gate 2026-06-19 12:23:23 -07:00
Jordan Ritter 808bc4741d feat(showcase): promote-closure SSOT (tiers/runtimeDeps/serviceRefs) + computePromoteClosure + 12 starter entries + oxfmt-canonical emit 2026-06-19 12:23:22 -07:00
Tyler Slaton e2f742dd27 fix(docs): add langgraph doctest dependencies 2026-06-19 12:21:56 -07:00
Tyler Slaton d1fb02bcd6 fix(shell-docs): canonicalize react guidance redirects 2026-06-19 12:09:30 -07:00
Jordan Ritter 802ffbbcc9 fix(cvdiag): _shared logging setup is inert when disabled — no host root-handler teardown at import; capture-when-enabled preserved + inert lever test (M5 CR R4)
setup() ran logging.basicConfig(force=True) unconditionally at import (module
calls setup() at the bottom), tearing down the host app's root-logger handlers
on every backend even when cvdiag was disabled (CVDIAG_BACKEND_EMITTER off,
canary-safe default) — violating the byte-for-byte-inert contract. Replaced the
root basicConfig(force=True) with a scoped StreamHandler attached to the
"agents" logger, installed ONLY on the ENABLED path (after _ENABLED=True), so a
disabled/degraded setup performs zero logging mutation and the host root
handlers survive. capture-when-enabled (agents.* → stdout) preserved.

Call sites: setup() defined cvdiag_bootstrap.py:133, invoked at import-time
:273 (now no longer touches root). is_enabled() :206 unchanged (gates emit).
basicConfig() call REMOVED from :128; only doc references remain. New scoped
_install_agents_log_capture() runs on the enabled path; reset_for_test() now
detaches the handler.
2026-06-19 12:02:55 -07:00
Jordan Ritter 530649864e fix(cvdiag): LGP gates request.ingress/llm.call.*/sse.first_byte to VERBOSE tier matching canonical _BOUNDARY_TIER (M5 CR R3)
The four §6-VERBOSE-only backend boundaries (request.ingress, llm.call.start,
llm.call.response, sse.first_byte) called _emit with no tier_gate, so they
over-emitted at DEFAULT tier — 4 extra events/request vs the middleware family,
breaking the §7 tier budget and cross-backend apples-to-apples parity. Gate
them with tier_gate=_VERBOSE_TIERS, matching emit.ts:58-63 and the agno
_BOUNDARY_TIER. langgraph-fastapi received the identical change (the two LGP
files differ only by docstring/plan-unit/_SLUG). Adds default-suppressed +
verbose-emits red-green coverage; updates the pre-existing first_byte
correlation test to drive at VERBOSE tier (the boundary is VERBOSE-only).
2026-06-19 11:42:52 -07:00
Jordan Ritter 75e2c53286 fix(cvdiag): _shared emit gate consults _ENABLED so the fail-closed DEBUG degrade actually suppresses emission (M5 CR R3)
emit_cvdiag now early-returns when not is_enabled(), in addition to the
per-integration CVDIAG_BACKEND_EMITTER env check, so a degraded setup()
(_ENABLED=False) emits nothing — the degrade wins over the live env toggle.

Call sites: shared emit_cvdiag (this file, the single chokepoint) now gates on
is_enabled() (the previously-dead _ENABLED flag, set False by setup()'s
fail-closed degrade). Per-integration emitter_enabled() (langgraph-python,
langgraph-fastapi) and cvdiag_backend_enabled() (10 other _cvdiag_backend.py
modules) remain env-only and call into emit_cvdiag — out of scope here; the
shared gate is the defense-in-depth backstop for all of them.
2026-06-19 11:42:52 -07:00
github-actions[bot] 861148ff38 style: auto-fix formatting 2026-06-19 18:41:49 +00:00
Tyler Slaton eb000d034e Fix frontend picker and docs routing 2026-06-19 11:38:17 -07:00
Jordan Ritter a9d2dd342e fix(cvdiag): backend scrub URL-userinfo+Bearer-tail parity + size-guard, live-tier consistency, stop_heartbeat cooperative-cancel across 12 emitters (M5 CR R1) 2026-06-19 11:23:35 -07:00
Jordan Ritter 2f2302cb65 fix(cvdiag): _shared pb_writer never-propagate drain + bootstrap degrade-not-crash + idempotent setup (M5 CR R1) 2026-06-19 11:23:31 -07:00
Jordan Ritter ec9923217f fix(cvdiag): d4 isMessagePost matches the agent-message POST specifically so messageSendEdge/edge_interference_signal/raw-byte aren't sourced from an unrelated POST (M7 CR R2) 2026-06-19 10:53:47 -07:00
Jordan Ritter dd25df8edd fix(cvdiag): cli-replay/cli-pb validateRow type-checks envelope fields (reject non-string ts/test_id, non-number mono_ns) instead of silently admitting → NaN sort (M7 CR R2) 2026-06-19 10:53:47 -07:00
Jordan Ritter 8b4ad2380b fix(cvdiag): A/B report — edge_interference_suspected is edge-arm-only + succeeding-pairs-only; mis-correlated pair does not present one arm's identity as authoritative (M7 CR R2) 2026-06-19 10:53:46 -07:00
Alem Tuzlak 588a2fb405 Merge branch 'main' into feat/bot-whatsapp 2026-06-19 19:45:21 +02:00
Jordan Ritter d4c660d44d fix(cvdiag): d4 A/B arm passes real L3 edge headers (edge_interference_signal no longer pinned false) + no orphan half-pair when internal arm absent (M7 CR R1) 2026-06-19 10:44:31 -07:00
Jordan Ritter ee575441cd fix(cvdiag): cli-classify test fixtures model genuine empty-200 (ruleH success-outcome), cli-replay asserts rows match queried test_id + hard-errors on empty/mismatch (M7 CR R1) 2026-06-19 10:44:31 -07:00
Jordan Ritter e2b08acae2 fix(cvdiag): A/B report — info is non-failure, detect slug/demo mis-correlation, consume edge_interference_signal, validate ab_pair_id (M7 CR R1) 2026-06-19 10:44:31 -07:00
Jordan Ritter d6573e7e7d fix(cvdiag): classifier — rule-h guarded to genuine empty-200 (no longer steals slow/err null-token cases from rule-a), truthful rule-f/g/h reason strings (M4 CR R2) 2026-06-19 10:27:42 -07:00
Jordan Ritter 74a976f4b2 fix(cvdiag): classifier rule accuracy — cross-layer tolerance sign, rule-f crash detection both signals, rule-g/h null normalization, mono_ns-ordered fact selection (M4 CR R1) 2026-06-19 10:19:52 -07:00
Jordan Ritter e32a593758 fix(cvdiag): raw-byte — re-cap head/tail to ≤16KB AFTER scrub (scrub grows bytes) in both branches + recompute elided_count post-scrub (M3 CR R5) 2026-06-19 10:05:59 -07:00
Jordan Ritter 4bd04f9ba4 fix(cvdiag): raw-byte — keep+scrub mislabeled-gzip plaintext (gzip-magic gate, no false drop), scrub full body before head/tail split to redact seam-straddling secrets (M3 CR R4) 2026-06-19 09:56:55 -07:00
Jordan Ritter 3356b90db9 fix(cvdiag): d4 probe — evict timing queue on responseless requests, preserve SSE backfill sequence order, fire probe.exit on abort path (M3 CR R3) 2026-06-19 09:44:50 -07:00
Jordan Ritter 6ca469952c fix(cvdiag): raw-byte — never store unscrubbed compressed body when gunzip throws, fix global-window clock-0 sentinel collision (M3 CR R3) 2026-06-19 09:44:49 -07:00
Jordan Ritter 77c5bedc76 fix(cvdiag): d4 probe data-correctness — per-request timing key, SSE timeout no double-emit, message.send edge-headers after response (M3 CR R1) 2026-06-19 09:29:18 -07:00
Jordan Ritter 760286646d fix(cvdiag): raw-byte decode correctness — code-point head/tail cap (≤16KB), dechunk validates CRLF/hex fail-closed, stripHtml no false dropped-flag, per-slug cap own constant (M3 CR R1) 2026-06-19 09:29:17 -07:00
Jordan Ritter 3308d732e8 fix(cvdiag): collection-gate hardening — 401≠exists (degrade), verify both collections, deny-tests assert CREATE+readback (M2 CR R4) 2026-06-19 09:05:18 -07:00
Jordan Ritter cc5b3ef6ea fix(cvdiag): complete + correct emit→PB wiring — invoke collection-check on both prod paths, typed status, raw-byte correlation test_id, writer-key test fidelity, drop dead queue (M2 CR R3) 2026-06-19 08:47:20 -07:00
Ran Shem Tov 7af24d7171 chore(showcase): label strands integration "AWS Strands (Python)" for TS parity
Now that strands-typescript ships as "AWS Strands (TypeScript)", rename the
existing Python integration's display name from "AWS Strands" to
"AWS Strands (Python)" so the two appear as a matched Python/TypeScript pair
in the docs framework selector and shell (mirrors LangGraph's
"(Python)"/"(TypeScript)" pairing). Slug, content, and behavior are
unchanged. The shared aws-strands docs language tabs already default per
framework (strands -> Python, strands-typescript -> TypeScript) via
TAB_DEFAULTS_BY_SLUG.
2026-06-19 17:45:02 +02:00
Ran Shem Tov 0e5b2189e7 feat(showcase): add strands-typescript integration with base demos
Add a new node/TypeScript-backed AWS Strands showcase integration at
showcase/integrations/strands-typescript.

Backend: a node/TS agent server (src/agent/) built on @strands-agents/sdk
`Agent`/`tool` wrapped in @ag-ui/aws-strands `StrandsAgent` and served via
@ag-ui/aws-strands/server (`createStrandsApp`/`addStrandsExpressEndpoint`),
modeled on the upstream ag-ui aws-strands TS example server and the
langgraph-typescript infra. A single shared agent at "/" serves most demos
(tools, shared state via toolBehaviors/stateContextBuilder, HITL,
sub-agents), with tool-free specialized agents mounted at /voice,
/byoc-hashbrown, /byoc-json-render. model-factory targets OpenAI chat
completions and honors OPENAI_API_KEY / OPENAI_BASE_URL so it works behind
the showcase aimock proxy. Node-based Dockerfile + entrypoint run the agent
server (:8000) alongside the Next.js frontend.

Frontend mirrors the strands (Python) sibling's demo set and the
langgraph-typescript conventions, with HttpAgent routes proxying to the TS
agent server.

Scope: base integration + standard demos only. A2UI / declarative-gen-ui /
a2ui-fixed-schema is intentionally excluded (no A2UI agents, routes, demos,
or deps) and layered on later.

Platform wiring (mirrors langgraph-typescript): docker-compose local/dev
services on host port 3119, local-ports.json, packages.json, slug-map.ts
(born-in-showcase), showcase_build.yml matrix + path filter + metadata,
shell-docs/dashboard registries, and a logo asset. The python strands
integration is untouched.
2026-06-19 17:38:02 +02:00
Jordan Ritter 3468198ba8 fix(showcase): un-fence ms-agent-harness-dotnet probing (#5577)
## Summary
Un-fences the `ms-agent-harness-dotnet` showcase column from per-cell
probe enumeration. The exclude was a placeholder added 2026-06-07
(commit f0edcd5d) before the column existed; the column shipped (PR
#5569) and its d6/d4 aimock fixtures landed today (e10df0b4), so the
fence is stale. Removed the slug from all 8 SSOT exclude sites
(catalog-enumerator.ts nameExcludes, 5 probe YAMLs, aimock-wiring.ts,
baseline-types.ts) + updated 3 stale comments/tests.

## Red-green proof (local, real control-plane surface)
- **RED** (origin/main): `enumerated services: [langgraph-python,
ms-agent-dotnet]` — slug present-in-nameExcludes:true → **0 d6 cells**.
- **GREEN (enumeration)**: after the edits, `enumerated services: [...,
ms-agent-harness-dotnet]` → slug enumerates (via the real
`railwayServicesSource.enumerate` + real `D6_DISCOVERY_FILTER`).
- **GREEN (value-test)**: live local control-plane D6 stack (aimock
fixtures) → **35 passed, 1 failed, 3 skipped, 3 incapable**.
- The single fail (`gen-ui-declarative` / sales-dashboard pie+bar charts
not rendering) is **at parity with the gold-standard sibling**:
PocketBase `d6:ms-agent-dotnet/gen-ui-declarative` is RED with the
byte-identical error (fail_count 92, since 2026-06-15) and is the
sibling's sole tolerated `1✗`. Shared sales-dashboard chart gap in the
ms-agent-dotnet family — not a regression from the AsHarnessAgent port.
Harness lands 35✓/1✗, matching the sibling.

## Test plan
- [ ] CI green
- [ ] After deploy, staging dashboard shows ms-agent-harness-dotnet
cells populating (BE✓, D6 filling) on the next probe tick
2026-06-19 08:37:44 -07:00
Alem Tuzlak f91f5d6968 Merge remote-tracking branch 'origin/main' into feat/bot-whatsapp
# Conflicts:
#	docs/model-allowlist.json
#	docs~origin_main
#	examples/slack/package.json
2026-06-19 17:26:54 +02:00
Jordan Ritter c786bf8846 fix(showcase): un-fence ms-agent-harness-dotnet probing
The ms-agent-harness-dotnet slug was excluded from per-cell D6/BE/smoke
probe enumeration by a placeholder fence added 2026-06-07, before the
real column existed. The column shipped in PR #5569 and its d6/d4 aimock
fixtures landed on main today (e10df0b4), so the fence is now stale.
Remove the slug from all 8 exclude SSOT sites so the column populates.
2026-06-19 08:04:54 -07:00
Jordan Ritter cbb5239b7d fix(cvdiag): wire emit→PocketBase persistence seam (writeBatch + inject pbWriter into production emitters) (cvdiag CR cross-cutting) 2026-06-19 07:56:09 -07:00
Jordan Ritter 7335d58359 fix(showcase): promote pins staging's running digest + verify serving + drift alarm (#5566)
## Summary

Fixes two correctness bugs in the showcase staging→prod promote path
(`showcase/bin/railway`), discovered + live-validated while promoting
the full 19-service cluster.

**Bug #1 — promote pinned the wrong digest.** `resolved_prod_image`
re-resolved the mutable `:latest` tag against *current* GHCR instead of
pinning the digest staging is actually *running*
(`latestDeployment.meta.imageDigest`). When `:latest` drifted after
staging deployed, promote pushed an unvalidated (and once, regressed)
image to prod. Now pins staging's running digest. Adds a loud `⚠️
STAGING DRIFT` warning (promote stdout + `STAGING_DRIFT_MARKER:` →
`promote-fleet.sh` aggregation → both Slack payloads) when staging's
running digest ≠ current `:latest`, so the gap is visible without
blocking the promote.

**Bug #2 — the pin never activated.** `pin_and_verify` used
`serviceInstanceRedeploy`, which replays the *existing* deployment's old
image rather than the just-pinned `source.image`. Config showed the new
digest while prod kept serving the old one (this is why earlier promotes
"succeeded" while prod stayed broken). Switched to
`serviceInstanceDeployV2` + a new `verify_serving_digest!` gate that
polls the new deployment to SUCCESS and **fails loud** if the running
digest ≠ pinned.

Plus CR-round hardening: P2 in-flight race check now reads
`meta.imageDigest` (was dead on tag-form staging) and skips on
`--digest` override; `detect_staging_drift` fails loud (WARN) on
GHCR-resolve failure instead of swallowing; `--digest` override
suppresses spurious drift; `drift_line` LF-stripped at the
`GITHUB_OUTPUT` boundary; multi-service drift join fixed; fallback-log
drift preserved.

## Commits
1. `fix(showcase): pin prod to staging's running digest + loud
staging-drift warning`
2. `fix(showcase): activate prod pin via serviceInstanceDeployV2 +
verify running==pinned`
3. `fix(showcase): harden promote P2 race check + refresh ivar-lint
allowlist`

## Validation
- Live red-green on real Railway: claude-sdk-python prod flipped from
stale → pinned digest via the fixed CLI; all 19 cluster services
promoted green; 5 previously-degraded backends (ag2, llamaindex,
pydantic-ai, ms-agent-python, strands) recovered.
- 15/15 Ruby specs + 15/15 bats green; ruby -c, shellcheck (CI
invocation), actionlint clean.
- 3-round cr-loop (7 agents/round) converged to zero bucket-(a).

## Follow-ups (not in this PR)
- Defensive `.to_s.empty?` on `meta.imageDigest` extraction
(can't-happen on real Railway).
- Test-quality nits (capture_io scoping, weak bats glob, shared mock
fixture).
- Pre-existing verify-prod `succeeded_csv`/`GITHUB_OUTPUT` coupling
(graceful-degraded, audited STAY_IN_C).
- `deploy-to-railway.ts` births prod on `:latest` (the root provisioning
gap); CLI↔workflow notify equivalence (PR2).

## Test plan
- [ ] CI green on PR HEAD
- [ ] (post-merge) a real `gh workflow run showcase_promote.yml` shows
the drift line in the #team-showcase notification when staging is behind
:latest
2026-06-19 07:55:46 -07:00
Alem Tuzlak 59773505eb feat(bot-slack): modernize native streaming (task chunks, feedback, single-message) (#5532)
## What

Brings `@copilotkit/bot-slack` up to the **current** Slack native
streaming API surface (`chat.startStream` / `appendStream` /
`stopStream`, GA Oct 2025; structured chunks + AI feedback elements) and
removes the type-erasure workarounds. Result of an audit
cross-referencing the live `@slack/web-api@7.16.0` /
`@slack/types@2.21.1` types and Vercel's `vercel/chat` Slack adapter.

## Changes

- **No more `as unknown as Parameters<…>` casts** — every
streaming/post/update call uses the SDK's typed args.
- **One streamed message per turn** — dropped the per-message
continuation splitting (Slack documents only a 12k-per-append limit, no
cumulative cap; matches `vercel/chat`), keeping ≤12k per-append
chunking.
- **Native `task_update` tool-progress chunks** (`task_display_mode:
"timeline"`) interleaved into the streamed reply, replacing the separate
`🔧` status messages — with automatic degradation back to
`🔧` rows where structured chunks aren't supported.
- **Opt-in AI feedback buttons** via `slack({ feedback })` — a typed
`context_actions` + `feedback_buttons` row attached at `stopStream`;
clicks are routed adapter-locally (bypassing the engine's interaction
dispatch). No handler ⇒ no buttons.
- **Recipient scoping** — `recipient_user_id` / `recipient_team_id` only
for channel targets.
- **Cadence** — native flush floor lowered to ~600ms (appendStream
Tier-4); legacy `chat.update` stays 800ms.

### Engine (`@copilotkit/bot`)
One small, backward-compatible addition: optional
`RunRenderer.finish?()`, called after `runAgentLoop` resolves, so a
turn-scoped renderer can finalize its single stream. No-op for existing
adapters.

## Verification

- `bot-slack`: type-check (both tsconfigs) clean, **208 tests pass**,
oxfmt + oxlint clean.
- `bot`: type-check clean, **33 tests pass** (incl. a new `finish()`
test).
- Reviewed for correctness (stream lifecycle, finish/interrupt
interaction, delta tracking, degradation) — no high-confidence bugs;
feedback-on-interrupt and missing-ref-logging were tightened.

### Not verifiable without a live workspace (flagged in-code)
- That a >12k reply truly streams into one message (the
no-cumulative-cap assumption).
- `startStream` with no initial content.
2026-06-19 16:50:03 +02:00
Jordan Ritter 61440691f2 fix(showcase): provision prod digest-pinned + image-drift prod-neutral (#5571)
## Summary

Two follow-up fixes that complete the pinned-prod / floating-staging
contract for the showcase fleet (the contract enforced by the promote
CLI in #5566). Prod services must be digest-pinned (`@sha256`), staging
floats `:latest`.

**Fix 1 — `showcase/scripts/deploy-to-railway.ts`: provision prod
digest-pinned, not `:latest`.**
Prod services were being *born* on the mutable `:latest` tag, then later
pinned only at promote time. Now they are born pinned to a resolved
`@sha256` digest at create time, via a new TS GHCR resolver that mirrors
the Ruby promote CLI (`/token` exchange → manifest HEAD →
`Docker-Content-Digest`). Resolution failure is **fail-loud**
(`process.exit(1)`, never a `:latest` fallback). `goLive` asserts the
prod `source.image` is digest-pinned (`assertProdDigestPinned`,
refactored to be dependency-injectable and to throw a typed
`ProdPinError` instead of exiting inline).

**Fix 2 — `showcase/harness/.../image-drift.ts`: stop flagging pinned
prod red.**
Under the pinned-prod contract, prod is intentionally digest-pinned
behind `:latest`, so the image-drift probe was firing false-red on every
prod service. It now renders such prod services **green**
(`pinnedExpected`) while a genuinely missing digest stays **red**.
Staging behaviour is unchanged.

## Verification

- **Red-green proven locally** for both new test surfaces:
- `assertProdDigestPinned` guard: RED = 5 tests `assertProdDigestPinned
is not a function` (untestable inline-exit) → GREEN = 13 passed after DI
refactor; env-mismatch branch: RED = `promise resolved undefined instead
of rejecting` → GREEN after wiring the test's env control.
- Suites: `deploy-to-railway.digest-pin.test.ts` **14 passed**;
`image-drift.test.ts` **26 passed**. Typecheck (scripts + harness) 0
errors; oxfmt + oxlint clean; harness build green.
- **Empirical 6b against live prod** (settled two reviewer
masking-concerns as can't-happen under current config):
- prod harness `SHOWCASE_ENV` is *unset* (not `""`) and
`RAILWAY_ENVIRONMENT_NAME="production"`, so `isProductionEnv()`'s `??`
correctly resolves true → the prod-neutral fix **fires** in prod.
- prod image-drift is discovery-only; all 19 prod `showcase-*` services
are digest-pinned and tag-less, so `expectedTag` resolves to `latest`
for every prod service → a fixed tag cannot reach prod image-drift (no
false-green).

## Review

3-round cr-loop (7 agents/round) converged to zero actionable findings.
One fix-introduced test-scaffolding defect (dead `envId` helper option)
was caught in the confirmation round and fixed. Remaining reviewer notes
are pre-existing issues in untouched goLive/probe code or
theoretical-but-can't-happen-under-live-config items, tracked as
follow-ups (not in scope for this PR).

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-06-19 07:44:29 -07:00
Jordan Ritter bce93f1e5e fix(cvdiag): pb-writer collection-existence check + forbid API updates (updateRule=null) + correct collision layer (M2 CR R2) 2026-06-19 07:44:16 -07:00