refactor(showcase): rename showcase/ops → showcase/harness

The monitoring/alerting service is a test harness (probes, assertions,
alerting), not an operations service. Rename the directory, package
name (@copilotkit/showcase-ops → @copilotkit/showcase-harness), all
internal references (Dockerfile, Prometheus metric prefix
showcase_ops_ → showcase_harness_, orchestrator log messages, probe
YAML nameExcludes, test fixtures), and regenerate pnpm-lock.yaml.

Wire protocol names (X-Ops-* headers) and shell-dashboard internal
API naming (OPS_BASE_URL, ops-api.ts) are intentionally unchanged —
they are stable contracts between sender and receiver.

Author: jpr5

pnpm-lock.yaml

@@ -9,13 +9,13 @@ packages:
   - "examples/showcases/generative-ui-playground"
   - "!examples/v1/_legacy"
   - "showcase/scripts"
-  - "showcase/ops"
+  - "showcase/harness"
   # NOTE: `showcase/shell-dashboard` is intentionally NOT part of this
   # pnpm workspace. It's a flat, standalone Next.js app that ships its
   # own package-lock.json and is built with `npm ci` (see its Dockerfile).
   # Including it here would force it into the pnpm lockfile, which
   # breaks its independent deploy path and invalidates the npm-based
   # Docker build. `showcase/scripts` IS in the workspace because the
-  # ops package imports from it and both use pnpm.
+  # harness package imports from it and both use pnpm.
 onlyBuiltDependencies:
   - better-sqlite3

pnpm-workspace.yaml

@@ -4,7 +4,7 @@ WORKDIR /repo
 RUN corepack enable
 
 COPY pnpm-workspace.yaml package.json pnpm-lock.yaml .pnpmfile.cjs ./
-COPY showcase/ops/package.json ./showcase/ops/package.json
+COPY showcase/harness/package.json ./showcase/harness/package.json
 # Copy every workspace package.json manifest (but NOT source / node_modules).
 # The version-drift probe's pnpm-packages discovery source parses these at
 # runtime. Doing this in the build stage (rather than COPY-ing packages/
@@ -23,10 +23,10 @@ RUN mkdir -p ./packages && \
 
 # `--ignore-scripts` skips the root `prepare` hook (lefthook install), which
 # requires `git` and is meaningless inside the build image. Deps themselves
-# don't rely on postinstall scripts in showcase-ops.
-RUN pnpm install --frozen-lockfile --ignore-scripts --filter @copilotkit/showcase-ops...
+# don't rely on postinstall scripts in showcase-harness.
+RUN pnpm install --frozen-lockfile --ignore-scripts --filter @copilotkit/showcase-harness...
 
-COPY showcase/ops ./showcase/ops
+COPY showcase/harness ./showcase/harness
 # e2e-smoke probe: generate registry.json at build time (the file is
 # gitignored, so it won't exist in a clean checkout). Copy the scripts
 # directory plus shared/packages metadata the generator reads, install
@@ -39,20 +39,20 @@ COPY showcase/scripts/ ./showcase/scripts/
 RUN cd showcase/scripts && npm ci --silent \
     && node node_modules/tsx/dist/cli.mjs generate-registry.ts
 
-RUN pnpm --filter @copilotkit/showcase-ops build
+RUN pnpm --filter @copilotkit/showcase-harness build
 
 # `pnpm deploy` materializes a standalone, hoisted node_modules with only
 # production deps into /deploy — no symlinks into /repo/node_modules/.pnpm.
 # Without this, the runtime stage would copy a pnpm-hoisted tree whose
 # symlinks point into paths that don't exist in the final image.
 # `--legacy` keeps pnpm v10+'s `deploy` usable without requiring
 # `inject-workspace-packages=true` across the repo — we don't use
-# injected workspace deps in showcase-ops.
+# injected workspace deps in showcase-harness.
 # Verified on pnpm 10.13.x — the `--legacy` flag semantics shifted in the
 # 10.x line (pre-10.x `deploy` was itself the legacy behavior and the flag
 # was a no-op). Pin the comment to the repo's committed pnpm version so
 # future upgrades surface the dependency.
-RUN pnpm --filter @copilotkit/showcase-ops --prod --legacy --ignore-scripts deploy /deploy
+RUN pnpm --filter @copilotkit/showcase-harness --prod --legacy --ignore-scripts deploy /deploy
 
 # Runtime stage: Debian-slim (not Alpine) because the e2e-smoke probe
 # driver launches chromium in-process via `playwright`. Playwright's
@@ -74,10 +74,10 @@ ENV QA_REPO_ROOT=/app
 # orchestrator reads the same env at runtime via `playwright`'s own
 # default resolution logic.
 ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
-COPY --from=build /repo/showcase/ops/dist ./dist
+COPY --from=build /repo/showcase/harness/dist ./dist
 COPY --from=build /deploy/node_modules ./node_modules
 COPY --from=build /deploy/package.json ./package.json
-COPY --from=build /repo/showcase/ops/config ./config
+COPY --from=build /repo/showcase/harness/config ./config
 # e2e-smoke probe: install chromium + its system deps. `--with-deps`
 # pulls in libnss3, libatk, libxkbcommon, libdrm, etc. via apt. Runs as
 # root because apt-get needs root. Call `playwright/cli.js` directly

showcase/ops/.gitignore showcase/harness/.gitignoreshowcase/ops/.gitignore renamed to showcase/harness/.gitignore

@@ -1,4 +1,4 @@
-# showcase-ops
+# showcase-harness
 
 In-cluster observability service for the showcase fleet. Runs on Railway, receives signed webhooks from GitHub Actions, executes cron-driven probes, persists state to PocketBase, classifies state transitions, and delivers alerts to Slack.
 
@@ -12,21 +12,21 @@ This section is for everyone who needs to add an alert rule, rotate a secret, or
 
 ## 1.1 Inspect a running instance
 
-Production URL: `https://showcase-ops-production.up.railway.app`
+Production URL: `https://showcase-harness-production.up.railway.app`
 
 - **`GET /health`** — JSON: `{status, pb, loop, rules, schedulerJobs}`. `pb:"ok"` means PocketBase reachable; `loop:"ok"` means the scheduler tick has advanced in the last interval; `rules` is the count of successfully compiled YAMLs; `schedulerJobs` is the count of registered cron entries.
 - **`GET /metrics`** — Prometheus exposition. Key counters:
-  - `showcase_ops_probe_runs{dimension=...}` — per-dimension probe executions
-  - `showcase_ops_alert_matches{rule=...}` — rule match count
-  - `showcase_ops_alert_sends{target=...}` — successful target deliveries
-  - `showcase_ops_rule_reloads` — increments on SIGHUP / file watcher reload
-  - `showcase_ops_webhook_rejections{reason=...}` — HMAC and payload-validation failures; `reason` is one of `stale`, `invalid-signature-format`, `invalid-signature`, `missing-signature`, `missing-timestamp`, `invalid-payload`, `unknown`
+  - `showcase_harness_probe_runs{dimension=...}` — per-dimension probe executions
+  - `showcase_harness_alert_matches{rule=...}` — rule match count
+  - `showcase_harness_alert_sends{target=...}` — successful target deliveries
+  - `showcase_harness_rule_reloads` — increments on SIGHUP / file watcher reload
+  - `showcase_harness_webhook_rejections{reason=...}` — HMAC and payload-validation failures; `reason` is one of `stale`, `invalid-signature-format`, `invalid-signature`, `missing-signature`, `missing-timestamp`, `invalid-payload`, `unknown`
 - **`POST /webhooks/deploy`** — HMAC-signed webhook ingest for `deploy.result` events. Canonical payload: `METHOD|PATH|TS|sha256(body)` with `sha256=<hex>` signature in `X-Ops-Signature`. Path must be the route constant (`/webhooks/deploy`), not `c.req.path`. 300s skew tolerance.
-- **Logs** — `railway logs --service showcase-ops` or the Railway dashboard. All lines are structured JSON: `{level, msg, ts, ...fields}`. Grep targets: `alert-engine.bootstrap-suppress` (gate suppressed a send), `writer.failed` (PB persist failed, always re-emits on bus), `suppress.eval-failed` (a suppress DSL expression threw), `rules.reload.failed` (load-time validation rejected a YAML).
+- **Logs** — `railway logs --service showcase-harness` or the Railway dashboard. All lines are structured JSON: `{level, msg, ts, ...fields}`. Grep targets: `alert-engine.bootstrap-suppress` (gate suppressed a send), `writer.failed` (PB persist failed, always re-emits on bus), `suppress.eval-failed` (a suppress DSL expression threw), `rules.reload.failed` (load-time validation rejected a YAML).
 
 ## 1.2 Environment variables
 
-All read at boot unless marked otherwise. See `showcase/ops/src/orchestrator.ts`.
+All read at boot unless marked otherwise. See `showcase/harness/src/orchestrator.ts`.
 
 **Required in production:**
 
@@ -35,7 +35,7 @@ All read at boot unless marked otherwise. See `showcase/ops/src/orchestrator.ts`
 | `POCKETBASE_URL`                | Internal PB endpoint (`http://showcase-pocketbase.railway.internal:8090`). Boot refuses to start if unset when `NODE_ENV=production`. |
 | `POCKETBASE_SUPERUSER_EMAIL`    | Admin auth for ops to write status rows.                                                                                              |
 | `POCKETBASE_SUPERUSER_PASSWORD` | Paired.                                                                                                                               |
-| `SHARED_SECRET`                 | Current HMAC secret for `/webhooks/deploy`. 64-hex recommended. Signer side lives in repo secret `SHOWCASE_OPS_SHARED_SECRET`.        |
+| `SHARED_SECRET`                 | Current HMAC secret for `/webhooks/deploy`. 64-hex recommended. Signer side lives in repo secret `SHOWCASE_HARNESS_SHARED_SECRET`.    |
 
 **Optional:**
 
@@ -58,12 +58,12 @@ All read at boot unless marked otherwise. See `showcase/ops/src/orchestrator.ts`
 
 | Secret                       | Used by                                           |
 | ---------------------------- | ------------------------------------------------- |
-| `SHOWCASE_OPS_URL`           | `notify-ops` step in `showcase_deploy.yml`.       |
-| `SHOWCASE_OPS_SHARED_SECRET` | Same — paired with the service's `SHARED_SECRET`. |
+| `SHOWCASE_HARNESS_URL`           | `notify-harness` step in `showcase_deploy.yml`.       |
+| `SHOWCASE_HARNESS_SHARED_SECRET` | Same — paired with the service's `SHARED_SECRET`. |
 
 ## 1.3 Alert rule YAMLs
 
-Location: `showcase/ops/config/alerts/*.yml`. The loader picks up every `.yml`/`.yaml` file except `_defaults.yml`, merges defaults in, compiles each rule through a Zod schema + structural validators, and hot-reloads on file changes (`chokidar`) or SIGHUP.
+Location: `showcase/harness/config/alerts/*.yml`. The loader picks up every `.yml`/`.yaml` file except `_defaults.yml`, merges defaults in, compiles each rule through a Zod schema + structural validators, and hot-reloads on file changes (`chokidar`) or SIGHUP.
 
 ### File layout
 
@@ -189,7 +189,7 @@ Dedupe key is `alpha-sorted([rule.id, key, trigger1, trigger2, ...])` joined by
 
 ## 1.3a Probe configs
 
-Location: `showcase/ops/config/probes/*.yml`. One YAML per probe. Loaded at startup + hot-reloaded via chokidar + SIGHUP, exactly like alert rules (`probes.reloaded` / `probes.reload.failed` emit on the bus on success/error).
+Location: `showcase/harness/config/probes/*.yml`. One YAML per probe. Loaded at startup + hot-reloaded via chokidar + SIGHUP, exactly like alert rules (`probes.reloaded` / `probes.reload.failed` emit on the bus on success/error).
 
 A probe config binds a `kind` (driver) to a `schedule` (cron) and a target shape. At each tick the scheduler calls the driver with one input per target; every driver invocation produces one `ProbeResult` which flows through `writer.write()` → `status.changed` → the alert engine. One YAML = one scheduler entry = N target invocations per tick.
 
@@ -289,13 +289,13 @@ First resolution per alias per process emits a `slack-webhook.alias-resolved` in
 
 ## 1.5 Shared-secret rotation
 
-See `showcase/ops/docs/rotation-drill.md` for the full runbook. Summary: stage `SHARED_SECRET_PREV` = current, set `SHARED_SECRET` = new, rotate GitHub Actions secret `SHOWCASE_OPS_SHARED_SECRET`, drop `PREV` after one full CI cycle confirms the new key works.
+See `showcase/harness/docs/rotation-drill.md` for the full runbook. Summary: stage `SHARED_SECRET_PREV` = current, set `SHARED_SECRET` = new, rotate GitHub Actions secret `SHOWCASE_HARNESS_SHARED_SECRET`, drop `PREV` after one full CI cycle confirms the new key works.
 
 ---
 
 # Part 2 — Build it, run it, extend it
 
-This section is for anyone touching `showcase/ops/src/` or the Dockerfile.
+This section is for anyone touching `showcase/harness/src/` or the Dockerfile.
 
 ## 2.1 Architecture
 
@@ -393,8 +393,8 @@ src/
 ## 2.3 Local dev
 
 ```bash
-cd showcase/ops
-pnpm install --filter @copilotkit/showcase-ops
+cd showcase/harness
+pnpm install --filter @copilotkit/showcase-harness
 pnpm dev                 # tsx watch src/orchestrator.ts
 
 # Or just run the built artifact:
@@ -420,13 +420,13 @@ All LLM-adjacent targets (none in this service today, but see `aimock`) should u
 
 ## 2.5 Build + deploy
 
-Production runs a single image on Railway, pulled from `ghcr.io/copilotkit/showcase-ops:latest`.
+Production runs a single image on Railway, pulled from `ghcr.io/copilotkit/showcase-harness:latest`.
 
 ```bash
 # 1) Build + push (amd64 is required — Railway runs x86 hosts)
 docker buildx build --platform linux/amd64 --push \
-  -f showcase/ops/Dockerfile \
-  -t ghcr.io/copilotkit/showcase-ops:latest .
+  -f showcase/harness/Dockerfile \
+  -t ghcr.io/copilotkit/showcase-harness:latest .
 
 # 2) Trigger a Railway redeploy pinned to the new digest.
 #    serviceInstanceDeployV2 forces a fresh snapshot — serviceInstanceRedeploy
@@ -438,13 +438,13 @@ curl -s -X POST https://backboard.railway.com/graphql/v2 \
   -d '{"query":"mutation { serviceInstanceDeployV2(serviceId:\"3a14bfed-0537-4d71-897b-7c593dca161d\", environmentId:\"b14919f4-6417-429f-848d-c6ae2201e04f\") }"}'
 
 # 3) Verify
-curl -s https://showcase-ops-production.up.railway.app/health
+curl -s https://showcase-harness-production.up.railway.app/health
 # {"status":"ok","pb":"ok","loop":"ok","rules":8,"schedulerJobs":3}
 ```
 
 Railway service/environment IDs above are for the `showcase` project's production environment.
 
-There is no CI workflow that auto-builds showcase-ops. Deploys are manual until a build job lands.
+There is no CI workflow that auto-builds showcase-harness. Deploys are manual until a build job lands.
 
 ## 2.6 Adding things
 
@@ -464,20 +464,20 @@ There is no CI workflow that auto-builds showcase-ops. Deploys are manual until
 
 - **PocketBase 0.22 auth** — superuser auth uses `/api/admins` (pre-0.23 endpoint); a warn-once log calls this out at boot. Upgrade path: drop the legacy fallback once deployed PB is 0.23+.
 - **No integration tests** — `test/integration/` and `test/e2e/` dirs exist but are empty. Unit coverage is dense (675 tests across 37 files) but no test hits a live PB or posts a real Slack webhook end-to-end.
-- **No auto-build workflow** — push to main does not produce a new `ghcr.io/copilotkit/showcase-ops:latest`; deploys are manual via §2.5.
+- **No auto-build workflow** — push to main does not produce a new `ghcr.io/copilotkit/showcase-harness:latest`; deploys are manual via §2.5.
 - **`/metrics` is unauthenticated** — intentional, gated by Railway private networking. If the service ever moves to a public mesh, add a scraper token.
 - **Bootstrap window is 15m and not env-overridable** — shift requires a code change to `AlertEngineDeps.bootstrapWindowMs`.
 
 ## 2.8 Related
 
-- `.github/workflows/showcase_deploy.yml` — sender side of the `/webhooks/deploy` handshake. `notify-ops` step signs and POSTs.
+- `.github/workflows/showcase_deploy.yml` — sender side of the `/webhooks/deploy` handshake. `notify-harness` step signs and POSTs.
 - `showcase/pocketbase/` — PB image + migrations. Deployed as `showcase-pocketbase` Railway service.
 - `showcase/aimock/` — fixture-based LLM mock. The aimock-wiring probe checks that every showcase package routes through it.
-- `showcase/ops/docs/rotation-drill.md` — secret rotation.
+- `showcase/harness/docs/rotation-drill.md` — secret rotation.
 
 ## 2.9 Legacy cron workflows — where their logic lives now
 
-The four legacy GitHub Actions cron workflows (`showcase_smoke-monitor`, `showcase_drift-detection`, `showcase_drift-report`, `showcase_redirect-report`) are replaced by in-process probes driven by showcase-ops. Each legacy workflow lane maps to one YAML probe config + one driver in `src/probes/drivers/`:
+The four legacy GitHub Actions cron workflows (`showcase_smoke-monitor`, `showcase_drift-detection`, `showcase_drift-report`, `showcase_redirect-report`) are replaced by in-process probes driven by showcase-harness. Each legacy workflow lane maps to one YAML probe config + one driver in `src/probes/drivers/`:
 
 | Legacy workflow                            | New probe YAML                            | Driver                  | Discovery          |
 | ------------------------------------------ | ----------------------------------------- | ----------------------- | ------------------ |

showcase/ops/Dockerfile showcase/harness/Dockerfileshowcase/ops/Dockerfile renamed to showcase/harness/Dockerfile

@@ -30,7 +30,7 @@ targets:
   - kind: slack_webhook
     webhook: oss_alerts
 
-# errorDesc is pre-sanitized in showcase/ops/src/probes/drivers/sanitize.ts
+# errorDesc is pre-sanitized in showcase/harness/src/probes/drivers/sanitize.ts
 # — triple-brace intentional so literal characters survive to Slack.
 template:
   text: |