Fix center safety bootstrap, scoped actions and profile load races; restore strict security gate

.github/workflows/api-validation.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+      - run: npm ci --workspace=@hydroland/api --include-workspace-root=true
       - run: npm --workspace @hydroland/api run db:generate
       # Legacy migration history contains pre-production migrations whose original SQL
       # cannot bootstrap a clean database (for example TEXT -> UUID FK drift).
@@ -37,6 +37,8 @@ jobs:
       # Forward migration immutability is enforced separately by Production Release Gate.
       - name: Bootstrap canonical schema on clean PostgreSQL
         run: npm --workspace @hydroland/api exec -- prisma db push --skip-generate
+      - name: Center license forward migration on TEXT and UUID asset keys
+        run: node apps/api/scripts/center-license-migration-db-e2e.mjs
       - name: Bootstrap raw equipment operational schema
         run: node apps/api/scripts/bootstrap-equipment-runtime-schema.mjs
       - name: Bootstrap trip weather operational schema
@@ -78,8 +80,8 @@ jobs:
       - run: npm run validate:translation -w @hydroland/api
       - run: npm run validate:marine -w @hydroland/api
       - run: npm run validate:integrations -w @hydroland/api
-      - run: npm run typecheck
-      - run: npm run build
+      - run: npm run typecheck --workspace=@hydroland/api
+      - run: npm run build --workspace=@hydroland/api
       - name: Credential upload payload and legacy schema regression
         run: node apps/api/scripts/credential-upload-regression.mjs
       - name: Credential storage configuration and readiness
@@ -145,6 +147,7 @@ jobs:
           MARINE_DOCS_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/marine-documents-http-e2e.mjs
           MARINE_READINESS_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/marine-readiness-http-e2e.mjs
           SAFETY_CHECKLIST_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/safety-checklist-http-e2e.mjs
+          CENTER_SAFETY_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/center-safety-http-e2e.mjs
           SAFETY_INCIDENTS_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/safety-incidents-http-e2e.mjs
           if ! PROFILE_E2E_BASE_URL=http://127.0.0.1:3101/api/v1 node apps/api/scripts/profile-account-http-e2e.mjs; then
             echo "Profile/Account HTTP/DB E2E failed; API log follows"

.github/workflows/dependency-lock.yml

@@ -4,10 +4,15 @@ on:
   pull_request:
     paths:
       - 'package.json'
+      - 'package-lock.json'
       - 'apps/**/package.json'
+      - 'scripts/release-dependency-audit*'
       - '.github/workflows/dependency-lock.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lock-and-audit:
     runs-on: ubuntu-24.04
@@ -16,39 +21,17 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - name: Generate deterministic lockfile
-        run: npm install --package-lock-only --ignore-scripts
-      - name: Audit high and critical vulnerabilities
-        run: |
-          npm audit --json > audit.json || true
-          node - <<'NODE'
-          const fs = require('fs');
-          const report = JSON.parse(fs.readFileSync('audit.json', 'utf8'));
-          const vulnerabilities = report.vulnerabilities || {};
-          const rows = Object.entries(vulnerabilities)
-            .filter(([, v]) => ['high', 'critical'].includes(v.severity))
-            .map(([name, v]) => ({
-              name,
-              severity: v.severity,
-              direct: v.isDirect,
-              range: v.range,
-              fixAvailable: v.fixAvailable,
-              via: (v.via || []).map(x => typeof x === 'string' ? x : {
-                source: x.source,
-                name: x.name,
-                title: x.title,
-                severity: x.severity,
-                range: x.range
-              })
-            }));
-          console.log(JSON.stringify({ metadata: report.metadata?.vulnerabilities || {}, highOrCritical: rows }, null, 2));
-          if (rows.length) process.exitCode = 1;
-          NODE
-      - name: Upload lockfile and audit report
+      - name: Validate committed lock by clean scoped installation
+        run: npm ci --workspace=@hydroland/api --workspace=@hydroland/web --include-workspace-root=true --ignore-scripts
+      - name: Reject lockfile mutation
+        run: git diff --exit-code -- package-lock.json
+      - name: Audit web/API release lock
+        run: node scripts/release-dependency-audit.mjs web-api audit.json
+      - name: Upload committed lockfile and audit report
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: dependency-lock-audit
+          name: web-api-lock-audit
           path: |
             package-lock.json
             audit.json

.github/workflows/mobile-security.yml

@@ -0,0 +1,36 @@
+name: Mobile release security (independent release)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mobile-security:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci --ignore-scripts
+      - name: Verify fail-closed audit contract
+        run: node scripts/release-dependency-audit.test.mjs
+      - name: Block vulnerable mobile releases including build tools
+        run: node scripts/release-dependency-audit.mjs mobile mobile-audit.json
+      - name: Retain full repository security coverage
+        if: always()
+        run: node scripts/release-dependency-audit.mjs repository repository-audit.json
+      - name: Upload mobile and full repository reports even on failure
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mobile-and-repository-security
+          path: |
+            mobile-audit.json
+            repository-audit.json
+          retention-days: 7

.github/workflows/mobile-validation.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+      - run: npm ci --workspace=@hydroland/mobile --include-workspace-root=false
       - run: npm --workspace @hydroland/mobile run test
       - run: npm --workspace @hydroland/mobile run typecheck
       - run: npm --workspace @hydroland/mobile run build

.github/workflows/pages-preview.yml

@@ -25,10 +25,13 @@ jobs:
           node-version: 22
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --workspace=@hydroland/web --include-workspace-root=true --ignore-scripts
 
       - name: Validate
-        run: npm run typecheck
+        run: npm run test --workspace=@hydroland/web
+
+      - name: Audit web/API release before publishing web artifact
+        run: node scripts/release-dependency-audit.mjs web-api audit.json
 
       - name: Build web
         run: npm run build --workspace @hydroland/web

.github/workflows/phase11-production-security.yml

@@ -9,8 +9,15 @@ on:
       - 'apps/api/src/main.ts'
       - 'apps/api/src/auth/**'
       - 'apps/api/scripts/phase11-production-security-validation.mjs'
+      - 'apps/api/scripts/runtime-dependency-boundary.mjs'
+      - 'apps/api/package.json'
+      - 'package.json'
+      - 'package-lock.json'
       - 'infra/**'
       - '.github/workflows/security-audit.yml'
+      - '.github/workflows/mobile-security.yml'
+      - 'scripts/release-dependency-audit*'
+      - 'scripts/build-*-release.mjs'
       - '.github/workflows/phase11-production-security.yml'
   pull_request:
     paths:
@@ -19,14 +26,34 @@ on:
       - 'apps/api/src/main.ts'
       - 'apps/api/src/auth/**'
       - 'apps/api/scripts/phase11-production-security-validation.mjs'
+      - 'apps/api/scripts/runtime-dependency-boundary.mjs'
+      - 'apps/api/package.json'
+      - 'package.json'
+      - 'package-lock.json'
       - 'infra/**'
       - '.github/workflows/security-audit.yml'
+      - '.github/workflows/mobile-security.yml'
+      - 'scripts/release-dependency-audit*'
+      - 'scripts/build-*-release.mjs'
       - '.github/workflows/phase11-production-security.yml'
   workflow_dispatch:
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: hydroland
+          POSTGRES_PASSWORD: hydroland
+          POSTGRES_DB: hydroland_image_test
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd "pg_isready -U hydroland -d hydroland_image_test"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgresql://hydroland:hydroland@127.0.0.1:5432/hydroland_image_test
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -36,6 +63,72 @@ jobs:
         run: node apps/api/scripts/phase11-production-security-validation.mjs
       - name: Build production API image
         run: docker build -t hydroland-api:phase11 .
+      - name: Build Compose API image
+        run: docker build -f apps/api/Dockerfile -t hydroland-api:compose .
       - name: Verify image runs as non-root user
         run: |
-          test "$(docker image inspect hydroland-api:phase11 --format '{{.Config.User}}')" = "node"
+          for image in hydroland-api:phase11 hydroland-api:compose; do
+            test "$(docker image inspect "$image" --format '{{.Config.User}}')" = "node"
+          done
+      - name: Verify installed runtime boundary and offline Prisma CLI
+        run: |
+          for image in hydroland-api:phase11 hydroland-api:compose; do
+            label="${image##*:}"
+            docker run --rm --network none --read-only --tmpfs /tmp --entrypoint node "$image" \
+              apps/api/scripts/runtime-dependency-boundary.mjs > "api-runtime-$label.json"
+            docker run --rm --network none --read-only --tmpfs /tmp --entrypoint node "$image" \
+              node_modules/prisma/build/index.js --version
+          done
+      - name: Audit API image dependencies (additional to full repository gate)
+        run: |
+          docker run --rm --entrypoint npm hydroland-api:phase11 \
+            audit --workspace=@hydroland/api --include-workspace-root=false --omit=dev --audit-level=high
+      - name: Verify final image starts and queries disposable PostgreSQL
+        run: |
+          # Historical migrations cannot bootstrap an empty database. This smoke
+          # checks runtime/engine readiness, not production migration acceptance.
+          docker run --rm --network host -e DATABASE_URL --entrypoint node hydroland-api:phase11 \
+            node_modules/prisma/build/index.js db push --schema apps/api/prisma/schema.prisma --skip-generate
+          docker run -d --name hydroland-image-smoke --network host --read-only --tmpfs /tmp \
+            -e DATABASE_URL -e PORT=3102 -e WEB_ORIGIN=http://127.0.0.1:4173 \
+            -e JWT_SECRET=ci-image-smoke-secret-at-least-32-characters \
+            --entrypoint node hydroland-api:phase11 apps/api/dist/main.js
+          trap 'docker logs hydroland-image-smoke; docker rm -f hydroland-image-smoke' EXIT
+          for attempt in {1..30}; do
+            if curl -fsS http://127.0.0.1:3102/api/v1/health/ready > /tmp/api-image-ready.json; then
+              node -e 'const r=require("/tmp/api-image-ready.json"); if(r.status!=="ready"||r.database!=="ok")process.exit(1)'
+              exit 0
+            fi
+            sleep 1
+          done
+          exit 1
+      - name: Verify native Render API build command and retained Prisma engine
+        run: |
+          cd apps/api
+          node ../../scripts/build-api-release.mjs > /tmp/native-api-build.log 2>&1 || { cat /tmp/native-api-build.log; exit 1; }
+          node ../../node_modules/prisma/build/index.js --version
+          node ../../node_modules/prisma/build/index.js db push --schema prisma/schema.prisma --skip-generate
+          JWT_SECRET=ci-native-api-secret-at-least-32-characters WEB_ORIGIN=http://127.0.0.1:4173 PORT=3103 NODE_ENV=production \
+            node dist/main.js > /tmp/native-api.log 2>&1 &
+          api_pid=$!
+          trap 'cat /tmp/native-api.log; kill "$api_pid" || true' EXIT
+          for attempt in {1..30}; do
+            if curl -fsS http://127.0.0.1:3103/api/v1/health/ready > /tmp/native-api-ready.json; then
+              node -e 'const r=require("/tmp/native-api-ready.json"); if(r.status!=="ready"||r.database!=="ok")process.exit(1)'
+              exit 0
+            fi
+            sleep 1
+          done
+          exit 1
+      - name: Verify native Render web build command
+        run: node scripts/build-web-release.mjs
+      - name: Retain installed runtime inventories
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: api-runtime-inventories
+          path: |
+            api-runtime-*.json
+            api-release-audit.json
+            web-release-audit.json
+          retention-days: 7

.github/workflows/production-release-gate.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+      - run: npm ci --workspace=@hydroland/api --workspace=@hydroland/web --include-workspace-root=true
       - run: npm --workspace @hydroland/api run db:generate
       - name: Verify production-applied migration checksums
         run: node apps/api/scripts/production-migration-baseline-validation.mjs
@@ -40,11 +40,11 @@ jobs:
           npm run validate:translation -w @hydroland/api
           npm run validate:marine -w @hydroland/api
       - name: Test
-        run: npm test
+        run: npm test --workspace=@hydroland/api --workspace=@hydroland/web --if-present
       - name: Typecheck
-        run: npm run typecheck
+        run: npm run typecheck --workspace=@hydroland/api --workspace=@hydroland/web --if-present
       - name: Build
-        run: npm run build
+        run: npm run build --workspace=@hydroland/api --workspace=@hydroland/web --if-present
       - name: Confirm production remains explicit
         shell: bash
         run: |

.github/workflows/release-candidate.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - run: npm ci
+      - run: npm ci --workspace=@hydroland/api --workspace=@hydroland/web --include-workspace-root=true
       - run: npm --workspace @hydroland/api run db:generate
       - name: API domain validations
         run: |
@@ -29,9 +29,9 @@ jobs:
           npm run validate:translation -w @hydroland/api
           npm run validate:marine -w @hydroland/api
           npm run validate:integrations -w @hydroland/api
-      - name: Workspace tests
-        run: npm test
-      - name: Typecheck all workspaces
-        run: npm run typecheck
-      - name: Build all workspaces
-        run: npm run build
+      - name: Web/API release tests
+        run: npm test --workspace=@hydroland/api --workspace=@hydroland/web --if-present
+      - name: Typecheck web/API release
+        run: npm run typecheck --workspace=@hydroland/api --workspace=@hydroland/web --if-present
+      - name: Build web/API release
+        run: npm run build --workspace=@hydroland/api --workspace=@hydroland/web --if-present

.github/workflows/security-audit.yml

@@ -6,37 +6,29 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   audit:
+    # User-approved release boundary: web/API/root, including build tools.
+    # Mobile and the full repository retain a separate failing security gate.
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-      - name: Install dependencies
-        run: npm ci
-      - name: Generate dependency audit report and enforce severity gate
-        shell: bash
-        run: |
-          npm audit --json > audit.json || true
-          node - <<'NODE'
-          const fs=require('fs');
-          const report=JSON.parse(fs.readFileSync('audit.json','utf8'));
-          const vulns=report.vulnerabilities||{};
-          const rows=Object.entries(vulns)
-            .filter(([,v])=>['high','critical'].includes(v.severity))
-            .map(([name,v])=>({name,severity:v.severity,direct:v.isDirect,range:v.range,fixAvailable:v.fixAvailable,via:(v.via||[]).map(x=>typeof x==='string'?x:{source:x.source,name:x.name,title:x.title,severity:x.severity,range:x.range})}));
-          console.log(JSON.stringify({metadata:report.metadata?.vulnerabilities||{},highOrCritical:rows},null,2));
-          if(rows.length){
-            console.error(`Security gate failed: ${rows.length} high/critical package vulnerabilities detected.`);
-            process.exit(1);
-          }
-          NODE
+      - name: Install web and API release dependencies
+        run: npm ci --workspace=@hydroland/api --workspace=@hydroland/web --include-workspace-root=true
+      - name: Verify fail-closed audit contract
+        run: node scripts/release-dependency-audit.test.mjs
+      - name: Audit web/API release including build dependencies
+        run: node scripts/release-dependency-audit.mjs web-api audit.json
       - name: Upload audit report
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: npm-audit-report
+          name: web-api-dependency-audit
           path: audit.json
           retention-days: 7