fix(server): heartbeat no longer trusts client-supplied updatedAt; add github reporter to e2e

A compute node heartbeat's capturedAt is untrusted client input (an
agent-reported reading), but both the in-memory and Postgres compute
control stores were using it directly as the row's own updatedAt
bookkeeping field -- letting a clock-skewed or malformed agent payload
propagate straight into it, and in the Postgres store specifically
risking a Zod validation failure on re-parse if capturedAt isn't a
strictly-formed ISO datetime. Both now generate updatedAt from the
store's own injected clock instead, matching every other write path in
these two files; lastHeartbeatAt still legitimately reflects the
agent's own capturedAt. Fixed a related SQL param-binding bug this
exposed in the Postgres store's UPDATE (updated_at was bound to the
same parameter as last_heartbeat_at).

Also added the 'github' reporter to e2e/playwright.config.ts's CI
reporter list -- without it a failing spec surfaces only as the job's
bare 'Process completed with exit code 1', with no file/line/assertion
in GitHub's own UI, forcing a full HTML-report artifact download just
to find out what broke.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

e2e/playwright.config.ts

@@ -23,7 +23,11 @@ export default defineConfig({
     // that's comfortably generous locally can still time out there. Give CI
     // more headroom uniformly rather than chasing each timeout one at a time.
     expect: { timeout: process.env.CI ? 20_000 : 10_000 },
-    reporter: process.env.CI ? [["list"], ["html", { open: "never" }]] : "list",
+    // "github" surfaces the failing test's file/line/error directly as a
+    // GitHub Actions annotation — without it, a CI failure here shows up
+    // only as the job's own bare "Process completed with exit code 1",
+    // forcing a full artifact download just to find out which spec failed.
+    reporter: process.env.CI ? [["list"], ["github"], ["html", { open: "never" }]] : "list",
     use: {
         // Only kept for a run that actually failed — cheap on disk, and the
         // difference between "it broke somewhere" and "here's exactly what

server/src/store/compute-control-store.ts

@@ -99,7 +99,11 @@ export class InMemoryComputeControlStore implements ComputeControlStore {
             devices: clone(heartbeat.devices), inventoryVersion: heartbeat.inventoryVersion,
             lastHeartbeatAt: heartbeat.capturedAt,
             state: existing.state === "offline" ? "online" : existing.state,
-            updatedAt: heartbeat.capturedAt,
+            // Server-generated, not the agent-supplied capturedAt: updatedAt
+            // is this row's own bookkeeping timestamp, and a heartbeat's
+            // capturedAt is untrusted client input — a clock-skewed or
+            // malformed agent payload must never propagate into it.
+            updatedAt: this.iso(),
         };
         this.nodes.set(key, node);
         return clone(node);

server/src/store/postgres-compute-control-store.ts

@@ -84,9 +84,13 @@ export class PostgresComputeControlStore implements ComputeControlStore {
             const node = computeNodeSchema.parse({
                 ...existing, freeCpuThreads: Math.min(existing.cpuThreads, heartbeat.freeCpuThreads), freeRamMB: Math.min(existing.totalRamMB, heartbeat.freeRamMB),
                 devices: heartbeat.devices, inventoryVersion: heartbeat.inventoryVersion, lastHeartbeatAt: heartbeat.capturedAt,
-                state: existing.state === "offline" ? "online" : existing.state, updatedAt: heartbeat.capturedAt,
+                // Server-generated, not the agent-supplied capturedAt: updatedAt
+                // is this row's own bookkeeping timestamp, and a heartbeat's
+                // capturedAt is untrusted client input — a clock-skewed or
+                // malformed agent payload must never propagate into it.
+                state: existing.state === "offline" ? "online" : existing.state, updatedAt: this.now().toISOString(),
             });
-            await client.query("UPDATE compute_nodes SET state=$3,inventory_version=$4,last_heartbeat_at=$5,document=$6,updated_at=$5 WHERE organization_id=$1 AND id=$2", [organizationId, nodeId, node.state, node.inventoryVersion, node.lastHeartbeatAt, JSON.stringify(node)]);
+            await client.query("UPDATE compute_nodes SET state=$3,inventory_version=$4,last_heartbeat_at=$5,document=$6,updated_at=$7 WHERE organization_id=$1 AND id=$2", [organizationId, nodeId, node.state, node.inventoryVersion, node.lastHeartbeatAt, JSON.stringify(node), node.updatedAt]);
             await client.query("DELETE FROM compute_accelerator_devices WHERE organization_id=$1 AND node_id=$2", [organizationId, nodeId]);
             for (const device of node.devices) await client.query(
                 "INSERT INTO compute_accelerator_devices(id,organization_id,node_id,health,vendor,total_vram_mb,free_vram_mb,document) VALUES($1,$2,$3,$4,$5,$6,$7,$8)",