Repository navigation
[S0] Contract first: scan.proto, generated Go/TS/OpenAPI/JSON Schema, stub ScanService, CI gates #6
Description
Delivery slice S0 of the Touchstone design.
Part of story #1, #2, #3, #4, #5.
Done when:
-
proto/touchstone/v1/scan.protomatches the design's Contracts section;buf generateproduces Go, TS (protobuf-es), OpenAPI andschema/scan-report.v1.json; generated code is committed and CI fails on a regeneration diff -
touchstone scan https://example.comprints a cannedScanReportthat validates against the generated JSON Schema -
fetch.Fetcher,vuln.Source,vuln.Enricher,repo.Forge,pipeline.EvidenceSourceinterfaces exist with in-memory fakes; CI (GitHub Actions) runsgo vet,staticcheck,go test,buf lint,buf breaking,tsc --noEmit,vitest run
Phase: 1 — make the flow work
Blocked by: none
Sprint: #17
Estimate: build 2h · CI+review 4h → ships 2026-10-26 (P50) / 2026-10-27 (P80) (uncalibrated: first sprint)
Waiting on: none
Runtime: runtime:claude (default)
Passive-only rule applies: only requests a browser loading the page would send, plus the design's discovery paths.
Part of #17 (Sprint 2026-W44)
Activity
containarium-ci commentedon Oct 22, 2026
The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.
Next: reply
@containarium statusto check on it, or@containarium stopto cancel it.— run
9d45ee40containarium-ci commentedon Oct 22, 2026
No change was proposed for this issue because the agent's run on the box failed. Nothing was pushed. Remove and re-add the trigger label to try again.
Next: reply
@containarium statusto see where this is, or re-add the trigger label to try again.— run
9d45ee40containarium-ci commentedon Oct 22, 2026
The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.
Next: reply
@containarium statusto check on it, or@containarium stopto cancel it.— run
70fef3a06 remaining items
containarium-ci commentedon Oct 23, 2026
The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.
Next: reply
@containarium statusto check on it, or@containarium stopto cancel it.— run
eadcf040containarium-ci commentedon Oct 23, 2026
No change was proposed for this issue because the agent's run on the box failed. Nothing was pushed. Remove and re-add the trigger label to try again.
Next: reply
@containarium statusto see where this is, or re-add the trigger label to try again.— run
eadcf040containarium-ci commentedon Oct 23, 2026
The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.
Next: reply
@containarium statusto check on it, or@containarium stopto cancel it.— run
2c7cc430containarium-ci commentedon Oct 23, 2026
No change was proposed for this issue because the agent's run on the box failed. Nothing was pushed. Remove and re-add the trigger label to try again.
Next: reply
@containarium statusto see where this is, or re-add the trigger label to try again.— run
2c7cc430hsinatfootprintai commentedon Oct 23, 2026
Design record for S0 (merged in #20). What shipped differs from
docs/architecture/touchstone.mdin these ways. The decisions stand as built; the design doc is being updated to match in #23 (issue #22).openapi/touchstone_v1.swagger.json, notopenapi/touchstone.v1.json(the plugin appends.swagger.jsonto the merge name).make generaterenames the ScanReport bundle toschema/scan-report.v1.json, the published schema. Bundles for the messages it references are also committed.web/src/gen/google/api/*_pb.ts(include_imports), whichscan_pb.tsneeds for the HTTP annotation.clean: true, andbuf.lockpinning googleapis. Usemake generate, notbuf generatealone.go,protoandweb.next build, the image build and the compose e2e come with S9 and S10.buf breakingis live now thatmainhas abuf.lock.web/package-lock.jsonyet: CI runsnpm install --no-package-lock. Follow-up: commit a lockfile and switch CI tonpm ci..githubpaths.