ev-dev-labs
diff --git a/‎.github/scripts/si_canonical_gate.py‎
Lines changed: 132 additions & 0 deletions b/‎.github/scripts/si_canonical_gate.py‎
Lines changed: 132 additions & 0 deletions
diff --git a/‎.github/workflows/load-test.yml‎
Lines changed: 16 additions & 5 deletions b/‎.github/workflows/load-test.yml‎
Lines changed: 16 additions & 5 deletions
diff --git a/‎.github/workflows/proto-gen-check.yml‎
Lines changed: 9 additions & 2 deletions b/‎.github/workflows/proto-gen-check.yml‎
Lines changed: 9 additions & 2 deletions
diff --git a/‎.github/workflows/security.yml‎
Lines changed: 33 additions & 20 deletions b/‎.github/workflows/security.yml‎
Lines changed: 33 additions & 20 deletions
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""SI canonical gate — Phase-44 / F7.
+
+Inspects /tmp/si.diff (unified=0, added lines only) for new legacy
+unit-suffixed identifiers and deprecated frontend conversion callers.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+DIFF_PATH = Path("/tmp/si.diff")
+
+ALLOWED_PREFIXES = [
+    "internal/ai/tools/",
+    "internal/api/ai_watch_face_nl_response_handler",
+    "internal/api/range_projection_handler",
+    "docs/",
+    "migrations/",
+]
+
+BANNED = [
+    re.compile(r"\b\w*(?:Distance|Range|Odometer|StartOdometer|EndOdometer)Mi\b"),
+    re.compile(r"\b\w*(?:Duration|Idle|Active)Min\b"),
+    re.compile(
+        r"\b\w*(?:Energy|Charge|Regen|EnergyUsed|EnergyAdded|EnergyDelivered)Kwh\b"
+    ),
+    re.compile(r"\b\w*(?:Power|AvgPower|MaxPower|ChargerPower)Kw\b"),
+    re.compile(r"\b\w*(?:Speed|AvgSpeed|MaxSpeed|GroundSpeed)Mph\b"),
+    re.compile(r"\b\w*(?:Pressure|TirePressure)Psi\b"),
+    re.compile(r"\b\w*(?:Temp|Temperature|InsideTemp|OutsideTemp)F\b"),
+    re.compile(r'json:"\w*_(?:mi|min|kwh|kw|mph|psi)"'),
+    re.compile(r'json:"\w*_(?:mi|min|kwh|kw|mph|psi),omitempty"'),
+    re.compile(
+        r"\b\w+_(?:mi|min|kwh|kw|mph|psi)\b\s+(?:NUMERIC|FLOAT|REAL|DOUBLE|INT|BIGINT|SMALLINT)"
+    ),
+]
+
+DEPRECATED_CALLERS = re.compile(
+    r"\b(convertDistance|convertSpeed|convertTemp|convertEfficiency|"
+    r"convertPressure|fmtDistance|fmtSpeed|fmtTemp|fmtPressure)\s*\("
+)
+
+ALLOWLIST_PATHS = {
+    "web/src/lib/unitConversion.ts",
+    "web/src/lib/unitConversion.test.ts",
+    "web/src/hooks/useSettings.ts",
+    "web/src/hooks/useSettings.test.ts",
+}
+
+
+def iter_added_lines(diff_text: str):
+    current_file = None
+    for line in diff_text.splitlines():
+        if line.startswith("+++ "):
+            path = line[6:].strip()
+            current_file = None if path == "dev/null" else path
+            continue
+        if line.startswith("---"):
+            continue
+        if not line.startswith("+"):
+            continue
+        if line.startswith("+++"):
+            continue
+        if current_file is None:
+            continue
+        yield current_file, line[1:]
+
+
+def check_go(diff_text: str) -> list[str]:
+    violations: list[str] = []
+    for current_file, added in iter_added_lines(diff_text):
+        if any(current_file.startswith(pfx) for pfx in ALLOWED_PREFIXES):
+            continue
+        s = added.lstrip()
+        if s.startswith("//") or s.startswith("#") or s.startswith("--"):
+            continue
+        for pat in BANNED:
+            if pat.search(added):
+                violations.append(f"{current_file}: {added.rstrip()}")
+                break
+    return violations
+
+
+def check_fe(diff_text: str) -> list[str]:
+    violations: list[str] = []
+    for current_file, added in iter_added_lines(diff_text):
+        if current_file in ALLOWLIST_PATHS:
+            continue
+        if not (current_file.endswith(".ts") or current_file.endswith(".tsx")):
+            continue
+        s = added.lstrip()
+        if s.startswith("//") or s.startswith("*"):
+            continue
+        if DEPRECATED_CALLERS.search(added):
+            violations.append(f"{current_file}: {added.rstrip()}")
+    return violations
+
+
+def main() -> int:
+    mode = sys.argv[1] if len(sys.argv) > 1 else "all"
+    diff_text = DIFF_PATH.read_text(encoding="utf-8", errors="replace") if DIFF_PATH.exists() else ""
+
+    if mode in ("go", "all"):
+        violations = check_go(diff_text)
+        if violations:
+            print("SI canonical gate FAILED. The following added lines introduce")
+            print("legacy unit-suffixed identifiers (mi/min/kwh/kw/mph/psi).")
+            print("Rename them to SI (m/s/wh/w/mps/kpa) per Phase-48 mandate:")
+            print()
+            for v in violations:
+                print(f"  {v}")
+            return 1
+        print("SI canonical gate PASSED — no new legacy unit-suffixed identifiers added.")
+
+    if mode in ("fe", "all"):
+        violations = check_fe(diff_text)
+        if violations:
+            print("SI canonical gate FAILED. Added lines call @deprecated unit")
+            print("conversion helpers. Use useUnits() + SI helpers instead:")
+            print()
+            for v in violations:
+                print(f"  {v}")
+            return 1
+        print("SI canonical gate (FE) PASSED.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -71,11 +71,22 @@ jobs:
           exit 1
 
       - name: Run k6
-        uses: grafana/k6-action@v0.3.1
-        with:
-          filename: tests/k6/api_smoke.js
+        # grafana/k6-action runs k6 in a sibling container, so localhost
+        # is not the compose-published API. Use host networking on
+        # ubuntu-latest so BASE_URL=http://localhost:8080 reaches the stack.
+        run: |
+          # k6 image is non-root; make the bind-mount writable so
+          # handleSummary / --summary-export can persist summary.json.
+          chmod a+w tests/k6
+          docker run --rm --network host \
+            -e BASE_URL=http://localhost:8080 \
+            -e SCENARIO="${SCENARIO}" \
+            -v "${GITHUB_WORKSPACE}/tests/k6:/scripts" \
+            -w /scripts \
+            --user "$(id -u):$(id -g)" \
+            grafana/k6:0.54.0 run /scripts/api_smoke.js
+          test -f tests/k6/summary.json
         env:
-          BASE_URL: http://localhost:8080
           SCENARIO: ${{ github.event.inputs.scenario || 'smoke' }}
 
       - name: Upload k6 summary
@@ -88,7 +99,7 @@ jobs:
 
       - name: Capture API logs on failure
         if: failure()
-        run: docker compose logs api > api.log
+        run: docker compose logs teslasync-api > api.log
         continue-on-error: true
 
       - name: Upload API logs
 
@@ -26,11 +26,18 @@ permissions:
 jobs:
   check:
     name: Verify generated Tesla protomodel matches proto
-    runs-on: ${{ inputs.runner || 'arc-runner' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: '1.25'
       - name: Verify generated files match proto
-        run: make gen-tesla-check
+        run: |
+          set -euo pipefail
+          go generate ./internal/tesla/protomodel/...
+          if ! git diff --quiet -- internal/tesla/protomodel/; then
+            echo "ERROR: generated files are out of sync with proto"
+            git --no-pager diff -- internal/tesla/protomodel/
+            exit 1
+          fi
@@ -136,22 +136,33 @@ jobs:
       - name: Verify Gitleaks policy catches secrets
         shell: bash
         run: |
-          fixture="$(mktemp -d)"
+          # Keep fixtures under the workspace so Docker bind-mounts work on
+          # self-hosted runners where host /tmp is not visible inside Docker.
+          fixture="$(pwd)/.gitleaks-policy-fixture"
+          rm -rf "$fixture"
+          mkdir -p "$fixture"
           trap 'rm -rf "$fixture"' EXIT
           write_private_key() {
             printf '%s %s\n%s\n%s %s\n' \
               '-----BEGIN' 'PRIVATE KEY-----' \
               'MIIEpgIBAAKCAQEA7Q0qj5WmCqvTNSiP1w3M9yKf9c2V8zR4' \
               '-----END' 'PRIVATE KEY-----' > "$1"
           }
-          for fixture_path in production.go internal/negative_test.go web/src/negative.test.ts; do
-            mkdir -p "$(dirname "$fixture/$fixture_path")"
-            write_private_key "$fixture/$fixture_path"
-            if docker run --rm \
+          run_detect() {
+            local source_dir="$1"
+            docker run --rm \
               -v "$(pwd)/.gitleaks.toml:/config.toml:ro" \
               -v "$fixture:/fixture:ro" \
               "${GITLEAKS_IMAGE}" \
-              detect --source="/fixture/$fixture_path" --config=/config.toml --no-git --redact --no-banner; then
+              detect --source="/fixture/${source_dir}" --config=/config.toml --no-git --redact --no-banner
+          }
+          n=0
+          for fixture_path in production.go internal/negative_test.go web/src/negative.test.ts; do
+            n=$((n + 1))
+            case_dir="pk-${n}"
+            mkdir -p "$fixture/$case_dir/$(dirname "$fixture_path")"
+            write_private_key "$fixture/$case_dir/$fixture_path"
+            if run_detect "$case_dir"; then
               echo "Gitleaks failed to detect generated $fixture_path" >&2
               exit 1
             fi
@@ -160,26 +171,24 @@ jobs:
           write_stopword_fixture() {
             printf 'const %s = "%s%s"\n' "$1" "$2" "$3" > "$4"
           }
+          n=0
           for fixture_path in source-stopword.go web/src/stopword.test.ts; do
-            mkdir -p "$(dirname "$fixture/$fixture_path")"
-            write_stopword_fixture token 'sk_live_' 'abcdef1234' "$fixture/$fixture_path"
-            if docker run --rm \
-              -v "$(pwd)/.gitleaks.toml:/config.toml:ro" \
-              -v "$fixture:/fixture:ro" \
-              "${GITLEAKS_IMAGE}" \
-              detect --source="/fixture/$fixture_path" --config=/config.toml --no-git --redact --no-banner; then
+            n=$((n + 1))
+            case_dir="stripe-${n}"
+            mkdir -p "$fixture/$case_dir/$(dirname "$fixture_path")"
+            write_stopword_fixture token 'sk_live_' 'abcdef1234' "$fixture/$case_dir/$fixture_path"
+            if run_detect "$case_dir"; then
               echo "Gitleaks failed to detect generated Stripe-like $fixture_path" >&2
               exit 1
             fi
           done
+          n=0
           for fixture_path in source-refresh.go web/src/refresh.test.ts; do
-            mkdir -p "$(dirname "$fixture/$fixture_path")"
-            write_stopword_fixture refresh_token 'rt_fake_refresh_token_for_seed_data_only_' 'abc123def456' "$fixture/$fixture_path"
-            if docker run --rm \
-              -v "$(pwd)/.gitleaks.toml:/config.toml:ro" \
-              -v "$fixture:/fixture:ro" \
-              "${GITLEAKS_IMAGE}" \
-              detect --source="/fixture/$fixture_path" --config=/config.toml --no-git --redact --no-banner; then
+            n=$((n + 1))
+            case_dir="refresh-${n}"
+            mkdir -p "$fixture/$case_dir/$(dirname "$fixture_path")"
+            write_stopword_fixture refresh_token 'rt_fake_refresh_token_for_seed_data_only_' 'abc123def456' "$fixture/$case_dir/$fixture_path"
+            if run_detect "$case_dir"; then
               echo "Gitleaks failed to detect generated refresh-token $fixture_path" >&2
               exit 1
             fi
@@ -193,6 +202,10 @@ jobs:
             "${GITLEAKS_IMAGE}" \
             detect --source=/fixture/allowlist-control --config=/config.toml --no-git --redact --no-banner
 
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "20"
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
         with: