fix release validation and imaging deployment

Author: voidstackloop

compose.dev.yml

@@ -108,7 +108,7 @@ services:
       keycloak:
         condition: service_started
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4000/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      test: ["CMD", "node", "-e", "require('node:http').get('http://127.0.0.1:4000/health',r=>{r.resume();process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"]
       interval: 5s
       timeout: 4s
       retries: 30
@@ -145,4 +145,3 @@ volumes:
   redis-dev-data:
   keycloak-dev-data:
   imaging-dev-data:
-

docs/RELEASE_VALIDATION_2026-08-31.md

@@ -0,0 +1,98 @@
+# ModelForge v1.3.0 release validation
+
+Date: 2026-08-31
+
+## Result
+
+The installed Windows release and the repository build passed the automated,
+integration, container, and visual checks listed below. The validation recording
+contains synthetic, PHI-free data and captures only the ModelForge application
+window.
+
+[Watch the compact release proof](assets/modelforge-v1.3.0-release-proof.mp4)
+
+## Installed release walkthrough
+
+The 3-minute, 655 KB H.264 recording demonstrates:
+
+- local-only chat and the new-chat workflow;
+- Runtime Manager detection and live telemetry for an NVIDIA RTX 4060;
+- balanced, performance, efficient, and manual resource profiles;
+- Download Center limits and concurrent-download controls;
+- audit, privacy, encryption, and audit-backend status;
+- a synthetic patient case and its inclusion controls;
+- Evidence Library and Knowledge Graph navigation.
+
+No AWS credential, AWS account identifier, prompt, patient identifier, or other
+secret is visible in the recording or this report.
+
+## Automated evidence
+
+| Area | Result |
+| --- | --- |
+| Desktop application unit tests | 1,018 passed, 1 skipped across 78 files |
+| Server default test mode | 650 passed, 84 skipped across 55 files |
+| Server with isolated PostgreSQL and Redis | 731 passed, 3 opt-in live-adapter tests skipped across 55 files |
+| Frontend tests | 101 passed |
+| Admin console tests | 61 passed |
+| MasterVault tests | 14 passed |
+| Rust native tests | 80 passed |
+| Playwright desktop E2E | 25 passed |
+| Imaging CDK regression tests | 3 passed |
+
+The Playwright suite covers approvals, audit persistence and backend migration,
+backup/restore, signed central policy handling, cancellation, Download Center,
+llama.cpp chat and agent tool gating, medication safety, onboarding, patient-case
+backend configuration, response contracts, settings persistence, and
+single-instance behavior.
+
+Production builds/typechecks passed for the desktop application, server,
+frontend, admin console, shared contracts, MasterVault, Rust native component,
+E2E package, and imaging CDK. Frontend and admin lint also passed.
+
+The development container stack was rebuilt and verified healthy. PostgreSQL,
+Redis, the API, Keycloak, and the admin console all started successfully; the API
+health endpoint returned `{"status":"ok"}` and the admin console returned HTTP
+200.
+
+## Defects corrected during validation
+
+1. The server container could load a stale copied `@modelforge/contracts`
+   package and fail during startup. The image now links the workspace contracts
+   package after dependency installation.
+2. The API health check did not reliably consume the response or terminate from
+   the HTTP status. It now exits deterministically after consuming the response.
+3. The PostgreSQL migration-audit test ordered same-timestamp events only by
+   `created_at`. It now asserts the audit ledger's monotonic numeric sequence.
+4. The imaging CDK stack contained a redundant exact-distribution KMS grant that
+   created a CloudFormation dependency cycle. The stack now relies on the CDK
+   OAC-generated, account-scoped distribution grant.
+5. The dedicated CloudFront access-log bucket used bucket-owner-enforced object
+   ownership, which is incompatible with CloudFront legacy standard logging. It
+   now enables the required object-writer ownership while retaining public-access
+   blocking. The PHI imaging bucket remains bucket-owner-enforced.
+6. CloudFormation descriptions used unsupported punctuation. They now use the
+   supported ASCII character set.
+
+Regression tests protect the CloudFront log-bucket ownership, KMS grant shape,
+and CloudFormation description character set.
+
+## External deployment status
+
+The imaging stack synthesized successfully after the fixes. Deployment reached
+AWS and exposed the CloudFront logging and dependency-cycle defects above, but a
+subsequent deploy is blocked before resource mutation because the account's CDK
+bootstrap toolkit is version 28 and the current deployment requires version 30.
+Upgrading the bootstrap stack changes account-level deployment IAM and therefore
+requires explicit operator approval. No credential value was read or printed.
+
+Production Compose configuration additionally requires deployment-specific
+`OIDC_ISSUER` configuration; no value was invented for validation.
+
+## Scope boundary
+
+This run verifies all repository-owned automated suites and the installed
+workflows listed above. Provider-dependent live imaging adapters, real clinical
+data flows, real external model/provider credentials, and the final AWS resource
+deployment require their respective controlled environments and are not claimed
+as exercised here.

docs/assets/modelforge-v1.3.0-release-proof.mp4

@@ -43,7 +43,7 @@ export class ImagingStack extends Stack {
         // once the bucket and distribution exist, scoped exactly to the
         // two principals the table calls for — nothing broader.
         const cmk = new kms.Key(this, "ImagingCmk", {
-            description: "CMK for ModelForge imaging object storage (DICOM instances) — see docs/IMAGING.md",
+            description: "CMK for ModelForge imaging object storage (DICOM instances) - see docs/IMAGING.md",
             enableKeyRotation: true,
             removalPolicy: RemovalPolicy.RETAIN,
         });
@@ -56,7 +56,11 @@ export class ImagingStack extends Stack {
             blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
             encryption: s3.BucketEncryption.S3_MANAGED,
             enforceSSL: true,
-            objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_ENFORCED,
+            // CloudFront standard logging (legacy) requires ACLs and CDK
+            // explicitly requires OBJECT_WRITER for a custom log bucket.
+            // This bucket contains access logs only; the PHI-bearing imaging
+            // bucket below remains BUCKET_OWNER_ENFORCED with ACLs disabled.
+            objectOwnership: s3.ObjectOwnership.OBJECT_WRITER,
             lifecycleRules: [{ expiration: Duration.days(365) }],
             removalPolicy: RemovalPolicy.RETAIN,
         });
@@ -86,7 +90,7 @@ export class ImagingStack extends Stack {
         });
 
         const distribution = new cloudfront.Distribution(this, "ImagingDistribution", {
-            comment: "ModelForge imaging (DICOM) content delivery — see docs/IMAGING.md",
+            comment: "ModelForge imaging (DICOM) content delivery - see docs/IMAGING.md",
             defaultBehavior: {
                 // withOriginAccessControl(): OAC, not the legacy OAI this
                 // table explicitly rules out — CDK wires the bucket policy
@@ -99,20 +103,14 @@ export class ImagingStack extends Stack {
             },
             logBucket: accessLogBucket,
             logFilePrefix: "cloudfront/",
-            minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
         });
 
-        // KMS grants: exactly the two principals the table names, nothing
-        // broader. The CloudFront OAC service principal is scoped to this
-        // one distribution's ARN — not "any CloudFront distribution in this
-        // account" — via aws:SourceArn, the standard pattern for an
-        // OAC-fronted, KMS-encrypted S3 origin.
-        cmk.grant(
-            new iam.ServicePrincipal("cloudfront.amazonaws.com", {
-                conditions: { StringEquals: { "aws:SourceArn": `arn:${this.partition}:cloudfront::${this.account}:distribution/${distribution.distributionId}` } },
-            }),
-            "kms:Decrypt"
-        );
+        // S3BucketOrigin.withOriginAccessControl() adds the CloudFront KMS
+        // decrypt statement itself. Its source ARN is limited to this AWS
+        // account's distributions but intentionally uses a distribution-ID
+        // wildcard: making the key policy depend on this distribution while
+        // the distribution also depends on the KMS-backed bucket creates a
+        // CloudFormation cycle and makes a first deployment impossible.
 
         // Server task role: s3:PutObject/GetObject/DeleteObject on the
         // bucket prefix, plus the KMS grants above. Explicitly NOT
@@ -121,7 +119,7 @@ export class ImagingStack extends Stack {
         // identity actually runs server/ (see README.md).
         const serverTaskRole = new iam.Role(this, "ImagingServerTaskRole", {
             assumedBy: new iam.ServicePrincipal("ecs-tasks.amazonaws.com"),
-            description: "Least-privilege role for the server/ process's S3ImagingObjectStore — attach to whatever compute actually runs it (see infra/imaging-cdk/README.md).",
+            description: "Least-privilege role for server S3 imaging access; attach to the compute running server (see infra/imaging-cdk/README.md).",
         });
         bucket.grantPut(serverTaskRole);
         bucket.grantRead(serverTaskRole);

infra/imaging-cdk/lib/imaging-stack.ts

@@ -7,6 +7,7 @@
     "scripts": {
         "build": "tsc",
         "clean": "rm -rf dist cdk.out",
+        "test": "tsx --test test/*.test.ts",
         "typecheck": "tsc --noEmit",
         "synth": "cdk synth",
         "diff": "cdk diff",

infra/imaging-cdk/package.json

@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { ImagingStack } from "../lib/imaging-stack.js";
+
+function synthesize(): Record<string, any> {
+    const directory = mkdtempSync(join(tmpdir(), "modelforge-imaging-cdk-"));
+    try {
+        const { publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+        const publicKeyPath = join(directory, "signing-public-key.pem");
+        writeFileSync(publicKeyPath, publicKey.export({ type: "spki", format: "pem" }));
+        const app = new App();
+        const stack = new ImagingStack(app, "TestImagingStack", {
+            env: { account: "111111111111", region: "eu-central-1" },
+            signingPublicKeyPath: publicKeyPath,
+            bucketNamePrefix: "modelforge-imaging-test",
+        });
+        return Template.fromStack(stack).toJSON();
+    } finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+}
+
+test("keeps ACLs enabled only on the dedicated CloudFront log bucket", () => {
+    const template = synthesize();
+    const resources = template.Resources as Record<string, any>;
+    const imagingBucket = Object.values(resources).find((resource: any) =>
+        resource.Type === "AWS::S3::Bucket" && resource.Properties?.LoggingConfiguration
+    ) as any;
+    assert.ok(imagingBucket, "expected the imaging bucket with server-access logging");
+
+    const logBucketId = imagingBucket.Properties.LoggingConfiguration.DestinationBucketName.Ref;
+    const logBucket = resources[logBucketId];
+    assert.deepEqual(logBucket.Properties.OwnershipControls.Rules, [{ ObjectOwnership: "ObjectWriter" }]);
+    assert.deepEqual(imagingBucket.Properties.OwnershipControls.Rules, [{ ObjectOwnership: "BucketOwnerEnforced" }]);
+    assert.deepEqual(logBucket.Properties.PublicAccessBlockConfiguration, {
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: true,
+    });
+});
+
+test("uses the OAC-generated account-scoped KMS grant without a distribution dependency cycle", () => {
+    const template = synthesize();
+    const key = Object.values(template.Resources as Record<string, any>).find((resource: any) => resource.Type === "AWS::KMS::Key") as any;
+    assert.ok(key, "expected a customer-managed KMS key");
+    const cloudFrontStatements = key.Properties.KeyPolicy.Statement.filter(
+        (statement: any) => statement.Principal?.Service === "cloudfront.amazonaws.com"
+    );
+    assert.equal(cloudFrontStatements.length, 1);
+    assert.deepEqual(
+        cloudFrontStatements[0].Condition.ArnLike["AWS:SourceArn"],
+        {
+            "Fn::Join": [
+                "",
+                [
+                    "arn:",
+                    { Ref: "AWS::Partition" },
+                    ":cloudfront::",
+                    { Ref: "AWS::AccountId" },
+                    ":distribution/*",
+                ],
+            ],
+        }
+    );
+});
+
+test("keeps CloudFormation descriptions within the supported character set", () => {
+    const template = synthesize();
+    for (const resource of Object.values(template.Resources as Record<string, any>) as any[]) {
+        const description = resource.Properties?.Description;
+        if (description === undefined) continue;
+        assert.match(description, /^[\u0009\u000A\u000D\u0020-\u007E\u00A1-\u00FF]*$/);
+    }
+});

infra/imaging-cdk/test/imaging-stack.test.ts

@@ -5,8 +5,13 @@ COPY packages/contracts/package.json packages/contracts/tsconfig.json ./packages
 COPY packages/contracts/src ./packages/contracts/src
 COPY server/package.json server/package-lock.json ./server/
 COPY server/vendor ./server/vendor
+# npm copies file: dependencies inside container builds. Point the server at
+# the workspace package so the development-stage contract build below is the
+# exact code imported by tsx, not a stale copy captured before that build ran.
 RUN --mount=type=cache,target=/root/.npm \
     npm --prefix server ci \
+    && rm -rf server/node_modules/@modelforge/contracts \
+    && ln -s ../../../packages/contracts server/node_modules/@modelforge/contracts \
     && ln -s ../../server/node_modules packages/contracts/node_modules
 
 FROM dependencies AS development

server/Dockerfile

@@ -138,7 +138,7 @@ describe.skipIf(!DATABASE_URL)("PostgresCaseMigrationStore (integration — requ
             await repo.rollback(session.id, ACTOR);
 
             const rows = await pool.query(
-                "SELECT action FROM audit_log WHERE organization_id = $1 AND target_id = $2 ORDER BY created_at",
+                "SELECT action FROM audit_log WHERE organization_id = $1 AND target_id = $2 ORDER BY sequence::bigint",
                 [orgId, session.id]
             );
             expect(rows.rows.map((r: { action: string }) => r.action)).toEqual([