[containarium-ci]

For #9: [S9] Web page: Next.js static export with URL input and report view, served by `touchstone serve`

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Adds the web report page for story #5 and the `touchstone serve` command that hosts it. Branch
agent/issue-9 already existed with uncommitted work from an earlier pass; I kept it, fixed the
failing test and missing build target, and committed it on top of main.

- web/: Next.js static export (output: export) with Tailwind, strict and noUncheckedIndexedAccess.
Responses are decoded with the generated fromJson(ScanReportSchema, ...).
- Report view: components grouped by confidence tier, ranked CVEs per component, evidence per
finding, the checked-locations list, and a 'Lookup incomplete' banner (no CVE count) when
lookup_status is not COMPLETE. An unreachable target shows as an error, not an empty report.
- touchstone serve: 127.0.0.1:8080 by default (--addr or TOUCHSTONE_ADDR). Serves the embedded
export and POST /v1/scans through grpc-gateway. Run make web-build before go build.
- Fix: isJsonValue rejects non-plain objects such as Date; an existing api.test.ts case was failing.

Tests: go vet and go test ./... pass; web tsc --noEmit and vitest run pass (42 tests); next build
exports the page. Not run: staticcheck (not installed on this box), and the dev verification
(fixture-vendor scan, then stopped-fixture error state), because there is no dev environment here.

Tools used
- go go1.27.3 linux/amd64 (already on the box, ~/.local/bin/go); gofmt -l reported nothing
- node v24.22.1 (already on the box, ~/.local/bin/node)
- npx: tsc, vitest and next, from web/node_modules at the versions pinned in web/package.json
(typescript 5.9.3, vitest 3.2.7, next 16.4.3); not installed by me in this session

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Branch agent/issue-9 already existed with uncommitted work from an earlier pass. I kept it and
   committed on top of main rather than starting over.
2. isJsonValue now rejects non-plain objects such as Date; an existing api.test.ts case expected
   that and was failing.
3. Added a web-build Makefile target. web/embed.go documents make web-build, but the Makefile did
   not define it.
4. Added "jsx": "react-jsx" to web/tsconfig.json so tsc accepts TSX. next build rewrites
   tsconfig.json, so that rewrite was reverted and only this line kept.
5. Ignored web/.next, web/next-env.d.ts and web/out build output in .gitignore. web/out/.gitkeep
   stays tracked so the go:embed pattern is valid on a fresh checkout.
6. The issue's dev verification (fixture-vendor scan, then stopped-fixture error state) was not run:
   this box has no dev environment. The result is unverified.
7. web/src/test/golden.ts is an existing test helper. report.test.ts keeps one `as JsonValue` cast
   on JSON.parse of the golden file; no app code casts.
8. staticcheck from make test was not run: it is not installed on this box and the issue did not ask
   for it to be installed.

Changes

• .gitignore — 6 lines
• Makefile — 29 lines
• cmd/touchstone/main.go — 98 lines
• cmd/touchstone/serve.go — 73 lines
• cmd/touchstone/serve_test.go — 37 lines
• internal/server/server.go — 30 lines
• internal/server/server_test.go — 79 lines
• web/embed.go — 18 lines
• web/next.config.mjs — 8 lines
• web/package.json — 28 lines
• web/postcss.config.mjs — 7 lines
• web/out/.gitkeep
• web/src/app/globals.css — 1 lines
• web/src/app/layout.tsx — 24 lines
• web/src/app/page.tsx — 5 lines
• web/src/components/component-card.tsx — 87 lines
• web/src/components/report-view.test.tsx — 128 lines
• web/src/components/report-view.tsx — 146 lines
• web/src/components/scan-form.tsx — 53 lines
• web/src/components/scan-page.test.tsx — 96 lines
• web/src/components/scan-page.tsx — 54 lines
• web/src/lib/api.test.ts — 63 lines
• web/src/lib/api.ts — 66 lines
• web/src/lib/report.ts — 52 lines
• web/src/lib/url.test.ts — 18 lines
• web/src/lib/url.ts — 9 lines
• web/src/test/golden.ts — 22 lines
• web/src/report.test.ts — 27 lines
• web/tsconfig.json — 16 lines
• web/vitest.config.ts — 13 lines

30 file(s) in all.

Acceptance, from the issue

• ✅ met `web/` is a Next.js static export with Tailwind, `strict` + `noUncheckedIndexedAccess`; responses are decoded with the generated `fromJson(ScanReportSchema, …)… — the agent says: output: export, Tailwind, strict and noUncheckedIndexedAccess set; fromJson in api.ts. One cast remains in a test file.
• ✅ met The page shows components grouped by confidence tier, ranked CVEs per component, evidence per finding, the checked-locations list, and a "lookup incomplete" ba… — the agent says: Tier grouping, ranked CVEs, evidence, checked list and banner in report-view.tsx; 42 Vitest tests pass.
• ✅ met `touchstone serve` (default `127.0.0.1:8080`) serves the embedded page and `POST /v1/scans` through grpc-gateway — the agent says: Default 127.0.0.1:8080; /v1/ via grpc-gateway plus page at /. Covered by httptest tests, not run live.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Tests, as reported by the agent: passed

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run 5cd78590). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.