feat(mcp): подготовить сервер и доступ к приёмке

.gitea/workflows/docker.yml

@@ -0,0 +1,498 @@
+name: Docker images
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.shx.one
+  GITEA_SERVER_URL: https://git.shx.one
+
+jobs:
+  prepare-release:
+    runs-on: ubuntu-latest
+    outputs:
+      should_release: ${{ steps.release.outputs.should_release }}
+      version: ${{ steps.release.outputs.version }}
+      tag: ${{ steps.release.outputs.tag }}
+      bump: ${{ steps.release.outputs.bump }}
+      release_url: ${{ steps.release.outputs.release_url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Test release version calculation
+        run: node --test .ci/scripts/compute-release.test.mjs
+
+      - name: Compute release metadata
+        id: release
+        shell: bash
+        env:
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ env.GITEA_SERVER_URL }}
+          BASE_VERSION: "1.0.0"
+          RELEASE_OUTPUT_DIR: .ci/release
+        run: |
+          set -euo pipefail
+          node .ci/scripts/compute-release.mjs
+          test -f .ci/release/release-manifest.json
+
+  backend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Start PostgreSQL 18
+        shell: bash
+        run: |
+          set -euo pipefail
+          NAME="mm-pg-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
+          docker rm -f "$NAME" 2>/dev/null || true
+          # Docker-backed Gitea runners execute this step in a separate container.
+          # Join its network; a published host loopback port is not reachable here.
+          NETWORKS=$(docker inspect --format '{{range $name, $network := .NetworkSettings.Networks}}{{println $name}}{{end}}' "$(cat /etc/hostname)" 2>/dev/null || true)
+          if [ -n "$NETWORKS" ]; then
+            test "$(printf '%s\n' "$NETWORKS" | wc -l)" -eq 1
+            NETWORK_ARGS=(--network "$NETWORKS" --network-alias "$NAME")
+            PG_HOST="$NAME"
+            PG_PORT=5432
+          else
+            # Host-based runners can use a Docker-assigned ephemeral host port.
+            NETWORK_ARGS=(-p 127.0.0.1::5432)
+            PG_HOST=127.0.0.1
+          fi
+          docker run -d --name "$NAME" --rm \
+            -e POSTGRES_USER=mmapp \
+            -e POSTGRES_PASSWORD=mmapp \
+            -e POSTGRES_DB=mmapp \
+            "${NETWORK_ARGS[@]}" \
+            postgres:18-alpine
+          echo "PG_CONTAINER=$NAME" >> "${GITHUB_ENV}"
+          if [ "$PG_HOST" = 127.0.0.1 ]; then
+            PG_PORT=$(docker port "$NAME" 5432/tcp | awk -F: '{print $NF}')
+          fi
+          echo "DATABASE_URL=postgres://mmapp:mmapp@${PG_HOST}:${PG_PORT}/mmapp" >> "${GITHUB_ENV}"
+          for i in $(seq 1 40); do
+            if docker exec "$NAME" pg_isready -U mmapp -d mmapp; then
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "PostgreSQL не поднялся"
+          docker logs "$NAME" || true
+          exit 1
+
+      - name: Install and test backend
+        shell: bash
+        env:
+          REQUIRE_TEST_POSTGRES: "1"
+        run: |
+          set -euo pipefail
+          npm ci
+          node --input-type=module <<'NODE'
+          import pg from 'pg';
+          const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL, connectionTimeoutMillis: 8000 });
+          try {
+            await pool.query('SELECT 1');
+            console.log('PostgreSQL reachable from the test process');
+          } finally {
+            await pool.end();
+          }
+          NODE
+          npm run test --prefix backend
+
+      - name: Stop PostgreSQL
+        if: always()
+        shell: bash
+        run: docker rm -f "${PG_CONTAINER:-}" 2>/dev/null || true
+
+  backend-image:
+    needs:
+      - prepare-release
+      - backend-test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure backend image name
+        shell: bash
+        run: |
+          set -euo pipefail
+          owner=$(echo "${{ gitea.repository }}" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+          name=$(echo "${{ gitea.repository }}" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+          stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+          echo "IMAGE_NAME=${{ env.REGISTRY }}/${owner}/${stem}-backend" >> "${GITHUB_ENV}"
+
+      - name: Prepare backend build context
+        shell: bash
+        run: |
+          set -euo pipefail
+          STAGING=".ci/docker/backend"
+          rm -rf "$STAGING"
+          mkdir -p "$STAGING/packages/contracts" "$STAGING/backend"
+          cp package-lock.json "$STAGING/"
+          node <<'NODE'
+          const fs = require("node:fs")
+          const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))
+          pkg.workspaces = ["packages/*", "backend"]
+          pkg.dependencies = {}
+          pkg.devDependencies = {}
+          delete pkg.scripts
+          fs.writeFileSync(".ci/docker/backend/package.json", `${JSON.stringify(pkg, null, 2)}\n`)
+          NODE
+          cp packages/contracts/package.json packages/contracts/tsconfig.json "$STAGING/packages/contracts/"
+          cp -R packages/contracts/src "$STAGING/packages/contracts/"
+          cp backend/package.json backend/tsconfig.json backend/mcp-coverage.json "$STAGING/backend/"
+          cp -R backend/src "$STAGING/backend/"
+          mkdir -p "$STAGING/backend/scripts/writer-profile"
+          cp backend/scripts/build-database-operator.mjs backend/scripts/database-writer-bootstrap-operator.mjs backend/scripts/database-writer-profile-operator.mts "$STAGING/backend/scripts/"
+          cp backend/scripts/writer-profile/operator-files.mjs backend/scripts/writer-profile/operator-contract.mjs backend/scripts/writer-profile/publisher.mjs backend/scripts/writer-profile/context.mjs backend/scripts/writer-profile/catalogue.mts backend/scripts/writer-profile/catalogue-value-bridge.ts backend/scripts/writer-profile/catalogue-projection.ts backend/scripts/writer-profile/catalogue-leaves.ts backend/scripts/writer-profile/application-writer-profile-catalogue.ts backend/scripts/writer-profile/application-writer-profile-catalogue-values.ts backend/scripts/writer-profile/application-writer-profile-catalogue-parent-policy.ts backend/scripts/writer-profile/application-writer-profile-canonical.ts backend/scripts/writer-profile/fixed44-build-sql.ts backend/scripts/writer-profile/fixed44-build-definition.ts backend/scripts/writer-profile/expanded44-data-policy.ts "${STAGING}/backend/scripts/writer-profile/"
+          mkdir -p "$STAGING/deploy/netflow-agent"
+          cp deploy/netflow-agent/install.sh "$STAGING/deploy/netflow-agent/"
+          if [ -d backend/drizzle ]; then
+            cp -R backend/drizzle "$STAGING/backend/"
+          fi
+
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+
+      - name: Build and push backend image
+        uses: docker/build-push-action@v5
+        with:
+          context: .ci/docker/backend
+          file: backend/Dockerfile
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            APP_VERSION=${{ needs.prepare-release.outputs.version }}
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
+            ${{ env.IMAGE_NAME }}:${{ needs.prepare-release.outputs.version }}
+          cache-from: type=gha,scope=backend
+          cache-to: type=gha,mode=max,scope=backend
+          labels: |
+            org.opencontainers.image.title=mmapp-backend
+            org.opencontainers.image.description=MikroTik Manager backend (Fastify)
+            org.opencontainers.image.version=${{ needs.prepare-release.outputs.version }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
+            org.opencontainers.image.created=${{ gitea.event.head_commit.timestamp }}
+
+  frontend-image:
+    needs: prepare-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute release metadata
+        shell: bash
+        env:
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ env.GITEA_SERVER_URL }}
+          BASE_VERSION: "1.0.0"
+          RELEASE_OUTPUT_DIR: .ci/release
+        run: |
+          set -euo pipefail
+          node .ci/scripts/compute-release.mjs
+          test -f .ci/release/release-manifest.json
+
+      - name: Configure frontend image name
+        shell: bash
+        run: |
+          set -euo pipefail
+          owner=$(echo "${{ gitea.repository }}" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+          name=$(echo "${{ gitea.repository }}" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+          stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+          echo "IMAGE_NAME=${{ env.REGISTRY }}/${owner}/${stem}-frontend" >> "${GITHUB_ENV}"
+
+      - name: Prepare frontend build context
+        shell: bash
+        run: |
+          set -euo pipefail
+          STAGING=".ci/docker/frontend"
+          rm -rf "$STAGING"
+          mkdir -p "$STAGING/packages/contracts" "$STAGING/public"
+          cp package-lock.json next.config.ts tsconfig.json postcss.config.mjs eslint.config.mjs components.json "$STAGING/"
+          node <<'NODE'
+          const fs = require("node:fs")
+          const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))
+          pkg.workspaces = ["packages/*"]
+          fs.writeFileSync(".ci/docker/frontend/package.json", `${JSON.stringify(pkg, null, 2)}\n`)
+          NODE
+          cp packages/contracts/package.json packages/contracts/tsconfig.json "$STAGING/packages/contracts/"
+          cp -R packages/contracts/src "$STAGING/packages/contracts/"
+          for dir in app components lib shared entities public hooks; do
+            if [ -d "$dir" ]; then
+              cp -R "$dir" "$STAGING/"
+            fi
+          done
+          cp .ci/release/release-manifest.json "$STAGING/public/release-manifest.json"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+
+      - name: Build and push frontend image
+        uses: docker/build-push-action@v5
+        with:
+          context: .ci/docker/frontend
+          file: Dockerfile.frontend
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            BACKEND_INTERNAL_URL=http://backend:8000
+            NEXT_PUBLIC_BACKEND_URL=same-origin
+            NEXT_PUBLIC_DEFAULT_DATA_SOURCE=live
+            NEXT_PUBLIC_ALLOW_MOCK_DATA=false
+            NEXT_PUBLIC_AUTH_PORTAL_URL=https://auth.shnt.top
+            NEXT_PUBLIC_APP_VERSION=${{ needs.prepare-release.outputs.version }}
+            NEXT_PUBLIC_RELEASE_URL=${{ needs.prepare-release.outputs.release_url }}
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
+            ${{ env.IMAGE_NAME }}:${{ needs.prepare-release.outputs.version }}
+          cache-from: type=gha,scope=frontend
+          cache-to: type=gha,mode=max,scope=frontend
+          labels: |
+            org.opencontainers.image.title=mmapp-frontend
+            org.opencontainers.image.description=MikroTik Manager frontend (Next.js)
+            org.opencontainers.image.version=${{ needs.prepare-release.outputs.version }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
+            org.opencontainers.image.created=${{ gitea.event.head_commit.timestamp }}
+
+  updater-image:
+    needs: prepare-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure updater image name
+        shell: bash
+        run: |
+          set -euo pipefail
+          owner=$(echo "${{ gitea.repository }}" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+          name=$(echo "${{ gitea.repository }}" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+          stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+          echo "IMAGE_NAME=${{ env.REGISTRY }}/${owner}/${stem}-updater" >> "${GITHUB_ENV}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+
+      - name: Build and push updater image
+        uses: docker/build-push-action@v5
+        with:
+          context: deploy/updater
+          file: deploy/updater/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
+            ${{ env.IMAGE_NAME }}:${{ needs.prepare-release.outputs.version }}
+          cache-from: type=gha,scope=updater
+          cache-to: type=gha,mode=max,scope=updater
+          labels: |
+            org.opencontainers.image.title=mmapp-updater
+            org.opencontainers.image.description=MikroTik Manager autonomous Docker updater
+            org.opencontainers.image.version=${{ needs.prepare-release.outputs.version }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
+            org.opencontainers.image.created=${{ gitea.event.head_commit.timestamp }}
+
+  netflow-agent-image:
+    needs: prepare-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure netflow-agent image name
+        shell: bash
+        run: |
+          set -euo pipefail
+          owner=$(echo "${{ gitea.repository }}" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+          name=$(echo "${{ gitea.repository }}" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+          stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+          echo "IMAGE_NAME=${{ env.REGISTRY }}/${owner}/${stem}-netflow-agent" >> "${GITHUB_ENV}"
+
+      - name: Test controller and installer
+        run: |
+          python3 -m unittest discover -s deploy/netflow-agent -p "test_*.py" -v
+          bash -n deploy/netflow-agent/install.sh
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea Registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.shx.one
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.ACTIONS_PAT }}
+
+      - name: Verify image with real WireGuard
+        run: |
+          docker build --target test -t mm-netflow-agent-test deploy/netflow-agent
+          docker run --rm --cap-drop ALL --cap-add NET_ADMIN --read-only --tmpfs /tmp -e FLOW_AGENT_KERNEL_TEST=1 --entrypoint python3 mm-netflow-agent-test -m unittest discover -s /app -p "test_agent.py" -v
+
+      - name: Build and push netflow-agent image
+        uses: docker/build-push-action@v5
+        with:
+          context: deploy/netflow-agent
+          file: deploy/netflow-agent/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
+            ${{ env.IMAGE_NAME }}:${{ needs.prepare-release.outputs.version }}
+          cache-from: type=gha,scope=netflow-agent
+          cache-to: type=gha,mode=max,scope=netflow-agent
+          labels: |
+            org.opencontainers.image.title=mmapp-netflow-agent
+            org.opencontainers.image.description=MikroTik Manager local WireGuard controller
+            org.opencontainers.image.version=${{ needs.prepare-release.outputs.version }}
+            org.opencontainers.image.revision=${{ gitea.sha }}
+            org.opencontainers.image.created=${{ gitea.event.head_commit.timestamp }}
+
+  publish-release:
+    needs:
+      - prepare-release
+      - backend-image
+      - frontend-image
+      - updater-image
+      - netflow-agent-image
+    if: needs.prepare-release.outputs.should_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute release metadata
+        shell: bash
+        env:
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ env.GITEA_SERVER_URL }}
+          BASE_VERSION: "1.0.0"
+          RELEASE_OUTPUT_DIR: .ci/release
+        run: |
+          set -euo pipefail
+          node .ci/scripts/compute-release.mjs
+          test -f .ci/release/release_notes.md
+
+      - name: Configure git author
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "gitea-actions[bot]"
+          git config user.email "gitea-actions[bot]@users.noreply.gitea"
+
+      - name: Create and push release tag
+        shell: bash
+        env:
+          TAG: ${{ needs.prepare-release.outputs.tag }}
+        run: |
+          set -euo pipefail
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping tag push"
+            exit 0
+          fi
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+
+      - name: Publish Gitea release
+        shell: bash
+        env:
+          TAG: ${{ needs.prepare-release.outputs.tag }}
+          VERSION: ${{ needs.prepare-release.outputs.version }}
+          REPOSITORY: ${{ gitea.repository }}
+          TOKEN: ${{ secrets.ACTIONS_PAT }}
+        run: |
+          set -euo pipefail
+          owner="${REPOSITORY%%/*}"
+          repo="${REPOSITORY#*/}"
+          payload=$(node <<'NODE'
+          const fs = require("node:fs")
+          const body = fs.readFileSync(".ci/release/release_notes.md", "utf8")
+          const payload = {
+            tag_name: process.env.TAG,
+            target_commitish: "main",
+            name: process.env.VERSION,
+            body,
+            draft: false,
+            prerelease: false,
+          }
+          process.stdout.write(JSON.stringify(payload))
+          NODE
+          )
+          status=$(curl --silent --show-error --output /tmp/gitea-release.json --write-out "%{http_code}" \
+            --request POST \
+            --header "Authorization: token ${TOKEN}" \
+            --header "Content-Type: application/json" \
+            --data "$payload" \
+            "${{ env.GITEA_SERVER_URL }}/api/v1/repos/${owner}/${repo}/releases")
+          if [ "$status" = "409" ] || [ "$status" = "422" ]; then
+            echo "Release for ${TAG} already exists (${status}), skipping"
+            exit 0
+          fi
+          if [ "$status" -lt 200 ] || [ "$status" -ge 300 ]; then
+            cat /tmp/gitea-release.json
+            exit 1
+          fi
+
+  notify-webhook:
+    needs:
+      - prepare-release
+      - backend-image
+      - frontend-image
+      - netflow-agent-image
+    runs-on: ubuntu-latest
+    env:
+      WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
+    steps:
+      - name: Notify deploy webhook
+        if: env.WEBHOOK_URL != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          curl --fail --silent --show-error --request POST \
+            --header "Content-Type: application/json" \
+            --data "{\"repository\":\"${{ gitea.repository }}\",\"sha\":\"${{ gitea.sha }}\",\"ref\":\"${{ gitea.ref }}\",\"version\":\"${{ needs.prepare-release.outputs.version }}\",\"tag\":\"${{ needs.prepare-release.outputs.tag }}\",\"releaseUrl\":\"${{ needs.prepare-release.outputs.release_url }}\"}" \
+            "$WEBHOOK_URL"

.gitea/workflows/mcp-acceptance-preview.yml

@@ -0,0 +1,276 @@
+name: MCP isolated acceptance preview images
+'on':
+  workflow_dispatch:
+    inputs:
+      expected_sha:
+        description: Exact reviewed full commit SHA on the selected ref; includes all accepted source changes
+        required: true
+        type: string
+      auth_portal_origin:
+        description: Canonical isolated browser-facing Auth Portal HTTP(S) origin; no path, credentials or query
+        required: true
+        type: string
+        default: http://127.0.0.1:55175
+permissions:
+  contents: read
+  packages: write
+jobs:
+  backend-preview:
+    if: ${{ gitea.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      COMPONENT: backend
+      EXPECTED_SHA: ${{ inputs.expected_sha }}
+      DISPATCH_SHA: ${{ gitea.sha }}
+      DISPATCH_EVENT: ${{ gitea.event_name }}
+      REPOSITORY: ${{ gitea.repository }}
+      RUN_ID: ${{ gitea.run_id }}
+      RUN_ATTEMPT: ${{ gitea.run_attempt }}
+    steps:
+    - name: Checkout exact dispatch commit
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ gitea.sha }}
+        persist-credentials: false
+    - name: Use existing Linux Node22 build toolchain
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+    - name: Verify source and isolated preview destination
+      shell: bash
+      run: |
+        set -euo pipefail
+        test "$DISPATCH_EVENT" = workflow_dispatch
+        [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+        test "$EXPECTED_SHA" = "$DISPATCH_SHA"
+        test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
+        git diff --exit-code
+        git diff --cached --exit-code
+        [[ "$RUN_ID" =~ ^[0-9]+$ && "$RUN_ATTEMPT" =~ ^[0-9]+$ ]]
+        owner=$(printf '%s' "$REPOSITORY" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+        name=$(printf '%s' "$REPOSITORY" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+        [[ "$owner" =~ ^[a-z0-9][a-z0-9._-]*$ && "$name" =~ ^[a-z0-9][a-z0-9._-]*$ ]]
+        stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+        echo "IMAGE_NAME=git.shx.one/$owner/$stem-$COMPONENT-mcp-acceptance" >> "$GITHUB_ENV"
+        echo "PREVIEW_TAG=mcp-acceptance-$EXPECTED_SHA-$RUN_ID-$RUN_ATTEMPT" >> "$GITHUB_ENV"
+        echo "PREVIEW_CACHE=git.shx.one/$owner/$stem-$COMPONENT-mcp-acceptance-buildcache:node-buildcache" >> "$GITHUB_ENV"
+        mkdir -p .ci/acceptance-evidence
+        node <<'NODE'
+        const fs=require('node:fs'),cp=require('node:child_process'),crypto=require('node:crypto');
+        const files=cp.execFileSync('git',['ls-files','-z'],{encoding:'utf8'}).split('\0').filter(Boolean);
+        const inputs=files.map(path=>{const info=fs.lstatSync(path);if(!info.isFile()||info.isSymbolicLink())throw Error('Regular tracked source inputs required');const data=fs.readFileSync(path);return {path,sha256:crypto.createHash('sha256').update(data).digest('hex'),bytes:data.length}});
+        fs.writeFileSync('.ci/acceptance-evidence/source.json',JSON.stringify({format:'mcp-preview-source-v1',repository:process.env.REPOSITORY,sourceSha:process.env.EXPECTED_SHA,sourceTree:cp.execFileSync('git',['rev-parse','HEAD^{tree}'],{encoding:'utf8'}).trim(),platform:'linux/amd64',component:process.env.COMPONENT,runId:process.env.RUN_ID,runAttempt:process.env.RUN_ATTEMPT,authPortalOrigin:process.env.AUTH_PORTAL_ORIGIN??null,inputs},null,2)+'\n');
+        NODE
+    - name: Prepare existing scoped Docker context
+      shell: bash
+      run: |
+        set -euo pipefail
+        STAGING=".ci/docker/backend"
+        rm -rf "$STAGING"
+        mkdir -p "$STAGING/packages/contracts" "$STAGING/backend"
+        cp package-lock.json "$STAGING/"
+        node <<'NODE'
+        const fs = require("node:fs")
+        const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))
+        pkg.workspaces = ["packages/*", "backend"]
+        pkg.dependencies = {}
+        pkg.devDependencies = {}
+        delete pkg.scripts
+        fs.writeFileSync(".ci/docker/backend/package.json", `${JSON.stringify(pkg, null, 2)}\n`)
+        NODE
+        cp packages/contracts/package.json packages/contracts/tsconfig.json "$STAGING/packages/contracts/"
+        cp -R packages/contracts/src "$STAGING/packages/contracts/"
+        cp backend/package.json backend/tsconfig.json backend/mcp-coverage.json "$STAGING/backend/"
+        cp -R backend/src "$STAGING/backend/"
+        mkdir -p "$STAGING/deploy/netflow-agent"
+        cp deploy/netflow-agent/install.sh "$STAGING/deploy/netflow-agent/"
+        if [ -d backend/drizzle ]; then
+          cp -R backend/drizzle "$STAGING/backend/"
+        fi
+        mkdir -p "$STAGING/backend/scripts/writer-profile"
+        cp backend/scripts/build-database-operator.mjs backend/scripts/database-writer-bootstrap-operator.mjs backend/scripts/database-writer-profile-operator.mts "$STAGING/backend/scripts/"
+        cp backend/scripts/writer-profile/operator-files.mjs backend/scripts/writer-profile/operator-contract.mjs backend/scripts/writer-profile/publisher.mjs backend/scripts/writer-profile/context.mjs backend/scripts/writer-profile/catalogue.mts backend/scripts/writer-profile/catalogue-value-bridge.ts backend/scripts/writer-profile/catalogue-projection.ts backend/scripts/writer-profile/catalogue-leaves.ts backend/scripts/writer-profile/application-writer-profile-catalogue.ts backend/scripts/writer-profile/application-writer-profile-catalogue-values.ts backend/scripts/writer-profile/application-writer-profile-catalogue-parent-policy.ts backend/scripts/writer-profile/application-writer-profile-canonical.ts backend/scripts/writer-profile/fixed44-build-sql.ts backend/scripts/writer-profile/fixed44-build-definition.ts backend/scripts/writer-profile/expanded44-data-policy.ts "${STAGING}/backend/scripts/writer-profile/"
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Log in to existing Gitea registry
+      uses: docker/login-action@v3
+      with:
+        registry: git.shx.one
+        username: ${{ gitea.actor }}
+        password: ${{ secrets.ACTIONS_PAT }}
+    - name: Build and push isolated acceptance image
+      id: build
+      uses: docker/build-push-action@v5
+      with:
+        context: .ci/docker/backend
+        file: backend/Dockerfile
+        platforms: linux/amd64
+        push: true
+        tags: ${{ env.IMAGE_NAME }}:${{ env.PREVIEW_TAG }}
+        build-args: APP_VERSION=${{ env.PREVIEW_TAG }}
+        cache-from: type=gha,scope=mcp-acceptance-backend
+        cache-to: type=gha,scope=mcp-acceptance-backend,mode=max
+        provenance: mode=min
+        sbom: true
+        labels: |-
+          org.opencontainers.image.revision=${{ gitea.sha }}
+          org.opencontainers.image.version=${{ env.PREVIEW_TAG }}
+          io.mmapp.acceptance-only=true
+    - name: Record exact digest and build metadata
+      shell: bash
+      env:
+        IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        BUILD_METADATA: ${{ steps.build.outputs.metadata }}
+      run: |
+        set -euo pipefail
+        node <<'NODE'
+        const fs=require('node:fs'),crypto=require('node:crypto');
+        const digest=process.env.IMAGE_DIGEST;if(!/^sha256:[a-f0-9]{64}$/.test(digest))throw Error('Exact registry digest required');
+        const metadata=JSON.parse(process.env.BUILD_METADATA);const source=fs.readFileSync('.ci/acceptance-evidence/source.json');
+        fs.writeFileSync('.ci/acceptance-evidence/image.json',JSON.stringify({format:'mcp-preview-image-v1',sourceSha:process.env.EXPECTED_SHA,sourceProofSha256:crypto.createHash('sha256').update(source).digest('hex'),image:process.env.IMAGE_NAME,tag:process.env.PREVIEW_TAG,digest,pinnedReference:process.env.IMAGE_NAME+'@'+digest,platform:'linux/amd64',component:process.env.COMPONENT,authPortalOrigin:process.env.AUTH_PORTAL_ORIGIN??null,buildMetadata:metadata,productionDeployed:false,wholeInstallation2GbAccepted:false},null,2)+'\n');
+        console.log('Acceptance image digest: '+process.env.IMAGE_NAME+'@'+digest);
+        NODE
+    - name: Retain source and image binding artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: mcp-acceptance-${{ env.COMPONENT }}-${{ gitea.sha }}-${{ gitea.run_id }}-${{ gitea.run_attempt }}
+        path: .ci/acceptance-evidence/*.json
+        if-no-files-found: error
+        retention-days: 14
+  frontend-preview:
+    if: ${{ gitea.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      COMPONENT: frontend
+      EXPECTED_SHA: ${{ inputs.expected_sha }}
+      DISPATCH_SHA: ${{ gitea.sha }}
+      DISPATCH_EVENT: ${{ gitea.event_name }}
+      REPOSITORY: ${{ gitea.repository }}
+      RUN_ID: ${{ gitea.run_id }}
+      RUN_ATTEMPT: ${{ gitea.run_attempt }}
+      AUTH_PORTAL_ORIGIN_REQUEST: ${{ inputs.auth_portal_origin }}
+    steps:
+    - name: Checkout exact dispatch commit
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ gitea.sha }}
+        persist-credentials: false
+    - name: Use existing Linux Node22 build toolchain
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+    - name: Validate explicit isolated portal origin
+      shell: bash
+      run: |
+        set -euo pipefail
+        node <<'NODE'
+        const fs=require('node:fs'),assert=require('node:assert/strict');
+        const raw=process.env.AUTH_PORTAL_ORIGIN_REQUEST;
+        assert(typeof raw==='string'&&raw.length>0&&raw.length<=2048&&!/[\x00-\x20\x7f]/.test(raw),'Bounded canonical HTTP(S) origin required');
+        const origin=new URL(raw);
+        assert(['http:','https:'].includes(origin.protocol)&&!origin.username&&!origin.password&&origin.pathname==='/'&&!origin.search&&!origin.hash&&origin.origin!=='null'&&origin.origin===raw,'Canonical origin only; credentials/path/query/hash refused');
+        fs.appendFileSync(process.env.GITHUB_ENV,'AUTH_PORTAL_ORIGIN='+origin.origin+'\n');
+        NODE
+    - name: Verify source and isolated preview destination
+      shell: bash
+      run: |
+        set -euo pipefail
+        test "$DISPATCH_EVENT" = workflow_dispatch
+        [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
+        test "$EXPECTED_SHA" = "$DISPATCH_SHA"
+        test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
+        git diff --exit-code
+        git diff --cached --exit-code
+        [[ "$RUN_ID" =~ ^[0-9]+$ && "$RUN_ATTEMPT" =~ ^[0-9]+$ ]]
+        owner=$(printf '%s' "$REPOSITORY" | cut -d/ -f1 | tr '[:upper:]' '[:lower:]')
+        name=$(printf '%s' "$REPOSITORY" | cut -d/ -f2 | tr '[:upper:]' '[:lower:]')
+        [[ "$owner" =~ ^[a-z0-9][a-z0-9._-]*$ && "$name" =~ ^[a-z0-9][a-z0-9._-]*$ ]]
+        stem=$(printf '%s' "$name" | sed -E 's/-[0-9]+$//')
+        echo "IMAGE_NAME=git.shx.one/$owner/$stem-$COMPONENT-mcp-acceptance" >> "$GITHUB_ENV"
+        echo "PREVIEW_TAG=mcp-acceptance-$EXPECTED_SHA-$RUN_ID-$RUN_ATTEMPT" >> "$GITHUB_ENV"
+        echo "PREVIEW_CACHE=git.shx.one/$owner/$stem-$COMPONENT-mcp-acceptance-buildcache:node-buildcache" >> "$GITHUB_ENV"
+        mkdir -p .ci/acceptance-evidence
+        node <<'NODE'
+        const fs=require('node:fs'),cp=require('node:child_process'),crypto=require('node:crypto');
+        const files=cp.execFileSync('git',['ls-files','-z'],{encoding:'utf8'}).split('\0').filter(Boolean);
+        const inputs=files.map(path=>{const info=fs.lstatSync(path);if(!info.isFile()||info.isSymbolicLink())throw Error('Regular tracked source inputs required');const data=fs.readFileSync(path);return {path,sha256:crypto.createHash('sha256').update(data).digest('hex'),bytes:data.length}});
+        fs.writeFileSync('.ci/acceptance-evidence/source.json',JSON.stringify({format:'mcp-preview-source-v1',repository:process.env.REPOSITORY,sourceSha:process.env.EXPECTED_SHA,sourceTree:cp.execFileSync('git',['rev-parse','HEAD^{tree}'],{encoding:'utf8'}).trim(),platform:'linux/amd64',component:process.env.COMPONENT,runId:process.env.RUN_ID,runAttempt:process.env.RUN_ATTEMPT,authPortalOrigin:process.env.AUTH_PORTAL_ORIGIN??null,inputs},null,2)+'\n');
+        NODE
+    - name: Prepare existing scoped Docker context
+      shell: bash
+      run: |
+        set -euo pipefail
+        STAGING=".ci/docker/frontend"
+        rm -rf "$STAGING"
+        mkdir -p "$STAGING/packages/contracts" "$STAGING/public"
+        cp package-lock.json next.config.ts tsconfig.json postcss.config.mjs eslint.config.mjs components.json "$STAGING/"
+        node <<'NODE'
+        const fs = require("node:fs")
+        const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))
+        pkg.workspaces = ["packages/*"]
+        fs.writeFileSync(".ci/docker/frontend/package.json", `${JSON.stringify(pkg, null, 2)}\n`)
+        NODE
+        cp packages/contracts/package.json packages/contracts/tsconfig.json "$STAGING/packages/contracts/"
+        cp -R packages/contracts/src "$STAGING/packages/contracts/"
+        for dir in app components lib shared entities public hooks; do
+          if [ -d "$dir" ]; then
+            cp -R "$dir" "$STAGING/"
+          fi
+        done
+        test -f "$STAGING/public/release-manifest.json"
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Log in to existing Gitea registry
+      uses: docker/login-action@v3
+      with:
+        registry: git.shx.one
+        username: ${{ gitea.actor }}
+        password: ${{ secrets.ACTIONS_PAT }}
+    - name: Build and push isolated acceptance image
+      id: build
+      uses: docker/build-push-action@v5
+      with:
+        context: .ci/docker/frontend
+        file: Dockerfile.frontend
+        platforms: linux/amd64
+        push: true
+        tags: ${{ env.IMAGE_NAME }}:${{ env.PREVIEW_TAG }}
+        build-args: |-
+          BACKEND_INTERNAL_URL=http://backend:8000
+          NEXT_PUBLIC_BACKEND_URL=same-origin
+          NEXT_PUBLIC_DEFAULT_DATA_SOURCE=live
+          NEXT_PUBLIC_ALLOW_MOCK_DATA=false
+          NEXT_PUBLIC_AUTH_PORTAL_URL=${{ env.AUTH_PORTAL_ORIGIN }}
+          NEXT_PUBLIC_APP_VERSION=${{ env.PREVIEW_TAG }}
+          NEXT_PUBLIC_RELEASE_URL=
+        cache-from: type=gha,scope=mcp-acceptance-frontend
+        cache-to: type=gha,scope=mcp-acceptance-frontend,mode=max
+        provenance: mode=min
+        sbom: true
+        labels: |-
+          org.opencontainers.image.revision=${{ gitea.sha }}
+          org.opencontainers.image.version=${{ env.PREVIEW_TAG }}
+          io.mmapp.acceptance-only=true
+    - name: Record exact digest and build metadata
+      shell: bash
+      env:
+        IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        BUILD_METADATA: ${{ steps.build.outputs.metadata }}
+      run: |
+        set -euo pipefail
+        node <<'NODE'
+        const fs=require('node:fs'),crypto=require('node:crypto');
+        const digest=process.env.IMAGE_DIGEST;if(!/^sha256:[a-f0-9]{64}$/.test(digest))throw Error('Exact registry digest required');
+        const metadata=JSON.parse(process.env.BUILD_METADATA);const source=fs.readFileSync('.ci/acceptance-evidence/source.json');
+        fs.writeFileSync('.ci/acceptance-evidence/image.json',JSON.stringify({format:'mcp-preview-image-v1',sourceSha:process.env.EXPECTED_SHA,sourceProofSha256:crypto.createHash('sha256').update(source).digest('hex'),image:process.env.IMAGE_NAME,tag:process.env.PREVIEW_TAG,digest,pinnedReference:process.env.IMAGE_NAME+'@'+digest,platform:'linux/amd64',component:process.env.COMPONENT,authPortalOrigin:process.env.AUTH_PORTAL_ORIGIN??null,buildMetadata:metadata,productionDeployed:false,wholeInstallation2GbAccepted:false},null,2)+'\n');
+        console.log('Acceptance image digest: '+process.env.IMAGE_NAME+'@'+digest);
+        NODE
+    - name: Retain source and image binding artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: mcp-acceptance-${{ env.COMPONENT }}-${{ gitea.sha }}-${{ gitea.run_id }}-${{ gitea.run_attempt }}
+        path: .ci/acceptance-evidence/*.json
+        if-no-files-found: error
+        retention-days: 14