[S9] Web page: Next.js static export with URL input and report view, served by touchstone serve

Delivery slice S9 of the Touchstone design.
Part of story #5.

Done when:

web/ is a Next.js static export with Tailwind, strict + noUncheckedIndexedAccess; responses are decoded with the generated fromJson(ScanReportSchema, …), no casts
The page shows components grouped by confidence tier, ranked CVEs per component, evidence per finding, the checked-locations list, and a "lookup incomplete" banner when lookup_status is not COMPLETE (Vitest + Testing Library)
touchstone serve (default 127.0.0.1:8080) serves the embedded page and POST /v1/scans through grpc-gateway

Verify on dev: run touchstone serve on dev, open the page, scan the fixture-vendor URL → report renders with the jQuery 1.12.4 component under Low confidence and its CVE list; then stop the fixture and scan again → an error state, not an empty report

Phase: 1 — make the flow work
Blocked by: #6
Sprint: #17
Estimate: build 3h · CI+review 4h · verify pass 0.5d → ships 2026-10-27 (P50) / 2026-10-28 (P80), verified in the batch pass 2026-10-30 (uncalibrated: first sprint)
Waiting on: none
Runtime: runtime:claude (default)

Passive-only rule applies: only requests a browser loading the page would send, plus the design's discovery paths.

Part of #17 (Sprint 2026-W44)

FYI (Q3 on #17, default accepted 2026-10-22): the SBOM/VEX upload field on the web page is built in #13, not here. Keep the page's form easy to extend with one more input.

The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

Next: reply @containarium status to check on it, or @containarium stop to cancel it.

— run 5cd78590

No change was proposed for this issue because the account the agent is signed in to on the box reached its usage limit. The limit resets at 2026-10-24 12:30 UTC. The platform will try this issue once more after the reset, if the issue is still open and still carries the trigger label. Nothing was pushed. Remove the trigger label to cancel that retry.

Next: reply @containarium status to see where this is, or re-add the trigger label to try again.

— run 5cd78590

feat(web): Next.js static page and touchstone serve (#9)

The agent proposed a change for this issue: #28

It was produced on a member's box and has not been built or tested by the platform. It is a pull request for a person to review; nothing is merged automatically.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Nothing was run: the sandbox denied go build/test, npm and git commit, so tests are not_run and
   the work is staged on agent/issue-9 but not committed. Run `go test ./...` and `make web-test`
   before merging.
2. npm dependency versions (next 16.0.10, react 19.2.0, tailwindcss 4.1.17, testing-library, jsdom
   27, plugin-react 5.1.0) are my best pins and could not be checked against the registry; adjust if
   install fails.
3. `web/out` is gitignored except `.gitkeep`, so `go build` works without building the page;
   `touchstone serve` then returns 404 for `/` until `make web-build` has run. A real build must run
   `make web-build` first.
4. The design also lists TOUCHSTONE_MAX_CONCURRENT_SCANS (default 2); not implemented here because
   the issue does not require it. Only the 180 s per-request timeout and TOUCHSTONE_ADDR are done.
5. The gateway marshals with default protojson options (no EmitUnpopulated) so the REST body matches
   the CLI JSON and the golden file that fromJson decodes.
6. A report with scan_status TARGET_UNREACHABLE is an RPC success from the Go service, so the page
   treats any non-OK scan_status as an error state showing the checked list; this meets the verify
   step 'error, not an empty report'.
7. serve has no --allow-private: scanning a private fixture-vendor from serve is refused per design
   D3, so the issue's verify-on-dev step may need S10's compose setup or a public fixture URL.
8. Suppressed vulnerabilities (VEX not affected/fixed) are shown dimmed with a badge rather than
   hidden, so a reviewer can see why they were suppressed.

— run adfcc6a0

fix(web): restore the web files of the previous attempt, keep the rea…

@containarium start
Continue the work on PR #28. Base your work on the PR branch agent/issue-9 (head d4f01b3), not on main: git fetch origin agent/issue-9 and check it out. main has no web code. Do not rewrite, rename or duplicate any existing file; make the smallest edits to the files already there.

State of the branch (verified: go vet, go test ./..., tsc --noEmit and vitest run all pass, 42 web tests): the real service.Scanner is wired in main.go and serve.go, and the web page is in web/src/components/ (report-view.tsx, scan-page.tsx, scan-form.tsx, component-card.tsx) with web/src/lib/api.ts.

Do only these remaining review items:

In web/src/components/report-view.test.tsx, add a test with two or more CVEs for one component in non-alphabetical order, and assert the order they appear in the DOM (ranking is currently unpinned).
Add a short touchstone serve section to README.md: --addr, TOUCHSTONE_ADDR, and make web-build before go build.
In internal/server/server_test.go, make TestPostScanRejectsOversizedBody assert the exact status (413 or 400) and that the service was not called, not only != 200.
In cmd/touchstone/serve.go, print a warning on stderr when TOUCHSTONE_ADDR binds a non-loopback address (the server has no auth). Add a test.

Hard limits: do not touch web/package.json, any dependency version, web/vitest.config.ts, web/tsconfig.json, or the Makefile. Do not add a second copy of any component. In the PR body state the base commit you started from and list the files you changed.

The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

Next: reply @containarium status to check on it, or @containarium stop to cancel it.

— run fdacf4d0

The agent looked at this issue and proposed no code change. Nothing was pushed and no pull request was opened.

Its reasoning, quoted as written by the agent (the platform has not reviewed it):

No change made. Issue #9 (S9) asks for three things that this repository does not contain yet: (1) a
Next.js static export with Tailwind and React components, plus Vitest and Testing Library tests; (2)
a touchstone serve command (gRPC plus grpc-gateway on 127.0.0.1:8080) that embeds the built page and
exposes POST /v1/scans; (3) a report page that shows the confidence tiers, CVE ranking, evidence,
checked locations and a lookup-incomplete banner. Today web/package.json has only
@bufbuild/protobuf, typescript and vitest, with no next, tailwind, react or testing-library.
cmd/touchstone/main.go implements only the scan subcommand, and the existing gateway and gRPC
generated code is not wired into any server. The issue also says it is blocked by #6, which I could
not verify. Writing this blind would mean guessing dependency versions and adding unverified Go and
TypeScript code, so I returned no files. The issue needs a scoped follow-up (for example, split
serve from the page) and a human decision on the dependency versions before a real change is
possible.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. No change made: S9 is an M-size slice needing new Next.js, Tailwind, React and Testing Library
   dependencies and a new serve command, none of which exist here; a partial change would not meet
   the done-when list.
2. Did not pin Next, Tailwind, React or Testing Library versions: none are declared in
   web/package.json and I could not query the registry, so any version would be a guess.
3. Could not confirm that blocking issue #6 is merged, because git commands required approval on
   this box; the branch agent/issue-9 was not created.
4. Go and npm commands (go version, npm view) required approval and were not run, so go vet,
   staticcheck, go test, npm install, tsc and vitest are all unverified.

This needs a person: answer or sharpen the issue, then reply @containarium start to run it again.

Next: answer or sharpen the issue, then reply @containarium start, or @containarium status to see where this is.

— run fdacf4d0

feat(web): static Next.js report page and touchstone serve (#9) (#28)

Delivered by merged PR #28 (squash 7b3d1ef): the Next.js static export, touchstone serve with the real scanner, and the report page. Closed by hand: the PR carries no closing keyword. Remaining should-level items from the review are tracked in #33 (ranking-order test, README for serve, exact oversize status, non-loopback warning). The dev verification step in this issue still needs a deploy (S10's compose setup or a public fixture URL, because serve has no --allow-private). Issues that list this one on a Blocked by: line (#10, #32, #33) can start now.

Navigation Menu

Repository navigation

[S9] Web page: Next.js static export with URL input and report view, served by `touchstone serve` #9

42 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[S9] Web page: Next.js static export with URL input and report view, served by touchstone serve #9

Description

Activity

hsinatfootprintai commented on Oct 22, 2026

containarium-ci commented on Oct 24, 2026

containarium-ci commented on Oct 24, 2026

42 remaining items

containarium-ci commented on Oct 26, 2026

hsinatfootprintai commented on Oct 26, 2026

containarium-ci commented on Oct 26, 2026

containarium-ci commented on Oct 26, 2026

hsinatfootprintai commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[S9] Web page: Next.js static export with URL input and report view, served by `touchstone serve` #9