Loop: devops/production hardening (LOOP-07,17,11,12,13)

[AetherAI3]

Summary

• Hardens CI, CodeQL, npm release provenance, package contents, installers, dependency updates, and production operations for aether-agent.
• Adds an executable production verifier that enforces workflow, release, installer, manifest, package allowlist/size, and installed-CLI invariants.
• Records the complete LOOP-07 → LOOP-17 → LOOP-11 → LOOP-12 → LOOP-13 evidence and governance trail.

Spec and final results: docs/specs/2026-07-20-devops-production-hardening-design.md

Why

Production safeguards were partly implicit or manual: Actions were not comprehensively pinned/least-privilege, publication lacked an exact-artifact smoke and attestation path, installer guidance allowed lifecycle risk, and no repeatable production-policy gate or operations runbook existed.

Impact

• Cross-platform Node 24 CI with immutable action pins, bounded jobs, clean installs, tests, audit, SBOM, and package-policy verification.
• Release-only npm publication from an exact tag on main, using the npm-production environment, OIDC provenance, build attestation, exact tarball smoke, and retained evidence.
• Version-selectable Bash/PowerShell installers that do not pipe remote code into a shell and suppress package lifecycle scripts.
• Windows workspace containment handles runner path aliases while retaining separate lexical traversal and canonical link-escape checks.
• Rollback, observability, backup, secret ownership, and repository-admin requirements documented.

Loop results

• LOOP-07 completed — code ready; repository/npm administrator controls recorded as operator-deferred
• LOOP-17 converged — 3 findings fixed; 5 consecutive no-new-finding rounds
• LOOP-11 passed — FREE-MAD score 74 → 92
• LOOP-12 passed without chaos — 10/10 declared high-risk mutants killed; chaos correctly skipped because no named sandbox or explicit approval was provided
• LOOP-13 completed — first drift/debt baseline established; composite 72.3 over evidenced axes

Validation

• Final npm test — 696/696
• Three pre-hosted-CI full-suite stability runs — 695/695 each
• Windows alias regression and existing traversal/link guards — 5/5 targeted
• npm run verify:production -- --tag v0.1.0 — exact package install/version/help smoke passed
• npm audit --audit-level=high — 0 known vulnerabilities
• CycloneDX SBOM generation and JSON parse
• Bash and PowerShell installer syntax validation
• Workflow YAML parse
• Targeted mutation score — 100% of the declared 10-mutant critical catalog

Operator gate after merge

A repository/npm administrator must verify or configure branch protection and required checks, the npm-production environment and reviewers, least-scope NPM_TOKEN, secret scanning/push protection, Dependabot alerts, and the private backup mirror. No live infrastructure or repository-admin mutation was attempted in this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.