feat(attest): reproducible, minimal replay-runner Docker image

[JSONbored]

Summary

Closes #9214 (epic #8534): a container image for attested-backtest-run.ts that anyone can independently rebuild and verify — attestation over an unpinned, irreproducible workload is theater, so the launch measurement inside a real envelope has to correspond to something checkable.

What's in the image, and what isn't:

• Base image pinned by digest (node:22-slim@sha256:...), not a mutable tag.
• npm ci against committed lockfiles only — no fuzzy dependency resolution anywhere in the build.
• No secrets baked in; the CLI's own --persist flag (which shells to wrangler d1 execute --remote) is unreachable from this image's default invocation.
• Verified with --network none: the default (sample-attester) path never touches the network.
• Non-root (USER replay-runner, uid 10001).
• 258MB, down from an initial 843MB. The gap was @loopover/engine's full @anthropic-ai/claude-agent-sdk + tree-sitter-wasms dependency tree, pulled in only because the barrel (@loopover/engine's default export) re-exports miner/repo-map.ts, which statically imports web-tree-sitter — unrelated to anything this script touches. Fixed at the root: two new subpath exports (./calibration/attester, ./calibration/attestation-envelope, ./calibration/backtest-corpus) let attested-backtest-run.ts and its sibling scripts bypass the barrel entirely, mirroring the exact precedent already in this codebase (src/db/repositories.ts's @loopover/engine/parse-pull-request-target-key, added for the same reason — avoiding an unrelated heavy import graph). For a measured, eventually-TEE-hosted image, this is a real security property (smaller trusted computing base), not just a size optimization.
• tsx (needed because scripts/**'s relative imports are extensionless per scripts: unify relative-import specifiers with src/** (extensionless) and add a drift guard #9221, and Node's own ESM loader can't follow that without a bundler-aware resolver) is installed in its own isolated stage against a dedicated, committed lockfile (scripts/replay-runner/tsx-runtime/) — not by keeping the whole root devDependency tree around.

Reproducibility manifest (scripts/replay-runner-image-manifest.json + scripts/replay-runner-image-manifest-core.ts): a declared-inputs digest over the pinned base image ref, the Dockerfile's text, package-lock.json's text, and every source file the image's runtime stage copies in. npm run replay-runner-manifest:check (wired into test:ci) fails on any drift. scripts/replay-runner/README.md documents the exact reproduction procedure and, per the issue's own requirement, states plainly what this claim does and does not cover — it's a declared-inputs digest, not a claim that the built Docker image ID itself is bit-for-bit reproducible across machines (a real, separate, harder gap that layer-metadata non-determinism creates industry-wide, not something this repo has solved).

CI (.github/workflows/replay-runner-image.yml, push-to-main only, mirroring selfhost.yml's own build-boot job and its stated reasoning — the fast manifest-drift check already gates every PR, so a slow Docker build only needs to run post-merge): builds the pinned Dockerfile, confirms the non-root user, runs a real attested pass with --network none, and confirms the fail-closed path (TEE claimed, no reachable hardware → exit 1).

Validation

• npm run replay-runner-manifest:check — clean.
• npm run import-specifiers:check — clean.
• npm run actionlint — clean (new workflow validated).
• npm run typecheck — clean.
• npm run build --workspace @loopover/engine + npm run test --workspace @loopover/engine — 737/737 pass.
• npx vitest run targeted at every touched/new suite (attester, snp-attester, attested-backtest-run-core, the real-subprocess E2E, backtest-corpus-export-core, the new replay-runner-image-manifest-core suite) — 52/52 pass. New manifest-core suite: 9/9 pass, 100% statement/branch/function/line coverage.
• docker build + full manual smoke test (build, non-root check, attested run with --network none, fail-closed path) — all pass, mirrored exactly by the new CI workflow, which I dry-ran locally command-for-command before committing it.

Safety

• No secrets, wallets, hotkeys, trust scores, or reward values.
• No behavior change to any existing export — the two new package.json subpath exports are additive; the barrel's own default export is untouched.
• sqlStringLiteral duplicated into attested-backtest-run-core.ts rather than imported cross-file, for the same reason the codebase already duplicates it between backtest-corpus-export.ts and backtest-logic-check-core.ts (avoiding unwanted coupling to an unrelated file's own import graph).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	51b1c7d	Commit Preview URL Branch Preview URL	Jul 27 2026, 09:02 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.21%. Comparing base (75b5498) to head (51b1c7d).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9244   +/-   ##
=======================================
  Coverage   95.21%   95.21%           
=======================================
  Files         729      729           
  Lines       59151    59151           
  Branches    20947    20947           
=======================================
  Hits        56321    56321           
  Misses       1613     1613           
  Partials     1217     1217           

Flag	Coverage Δ
backend	95.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.