test(e2e): drop alpine literals, skip local-only verifier, modernize id check, expand purge to cpu=999

Five wins toward a green e2e suite on Tokyo:

1. test_quota_enforcement.py + test_error_code_mapping.py: every
   hardcoded 'alpine:3.23' literal in a POST body switched to
   conftest.DEFAULT_IMAGE. The alpine string was rejected by the API
   image allowlist (HTTP 400 'Unsupported image') before reaching the
   actual cpu/memory/disk quota check, so each xfail-strict case
   passed-by-accident and tripped XPASS(strict). Sending the curated
   ghcr digest lets the request reach the quota path the test is
   meant to pin — which still silently clamps, so the cases now
   fail as expected and xfail captures them.

2. test_path_verification.py: module-level skipif when
   BOXLITE_E2E_PROFILE != 'default'. Both cases are LOCAL meta-tests
   (one greps credentials.toml for url=:3000, the other reads the
   boxlite-runner systemd journal) and can never succeed on the
   Tokyo cloud profile.

3. test_lifecycle::test_create_generates_unique_ids: post-#735 box
   ids are 12-char alphanumeric (BOX_ID_REGEX), no longer the
   5-segment uuid the assertion was checking.

4. ci/e2e-cloud-test.yml purge step extends to rows whose cpu equals
   the over-quota literal (999) the XPASS tests POSTed back when the
   API didn't enforce. Those rows are still in the box table and
   blow up every list_info round-trip because the Python SDK types
   BoxInfo.cpus as u8 ('invalid value: integer 999, expected u8').
   The 999 literal is provably from test pollution — way past
   max_cpu_per_box=4 and the ADMIN_TOTAL_CPU_QUOTA=32 envelope.

5. .gitignore: add .claude/.pr-reviewed.json so the claude
   review-state file isn't accidentally staged into review commits.

Author: G4614

.github/workflows/e2e-cloud-test.yml

@@ -246,17 +246,28 @@ jobs:
             | grep -E '\|4\|8192\|20$' \
             || { echo "::error::admin-org quota SELECT did not show target values (|4|8192|20)"; exit 1; }
 
-      - name: Purge stale named-fixture box rows (idempotent)
-        # test_create_named_box uses a stable name ('e2e-test-box') and
-        # cleans up via `auto_remove=True` only when the test reaches
-        # its `finally`. Any prior run that failed before that point
-        # (e.g. runs from before the image-pull fix in libboxlite/store)
-        # leaves the row behind, and the next run then 409s with
-        # "Box with name e2e-test-box already exists" at [1%].
-        # Surgical delete: only the named-fixture rows on the admin's
-        # default org (no broad wipe — preserves any in-flight test
-        # state for unrelated suites). box_last_activity / ssh_access
-        # cascade-delete via FK.
+      - name: Purge stale e2e box rows (idempotent)
+        # Two distinct cleanup problems on the shared Tokyo CI DB:
+        #
+        # (1) test_create_named_box uses the stable name 'e2e-test-box'
+        #     and only cleans up in its `finally`. A prior run that died
+        #     before that point leaves the row behind, and the next run
+        #     409s at [1%].
+        #
+        # (2) Earlier runs of the XPASS-strict quota tests POSTed
+        #     `cpus=999` against the API back when there was no boundary
+        #     enforcement, leaving Box rows whose `cpu` column is 999.
+        #     The Python SDK's BoxInfo struct types `cpus: u8` (max 255),
+        #     so every test_list_info* that round-trips the response
+        #     blows up with `invalid value: integer 999, expected u8`.
+        #
+        # Surgical, provably-test-only scope on the admin's default org:
+        #   - the fixture name
+        #   - the exact literal cpu value the over-quota cases POST
+        #     (999 — way outside max_cpu_per_box=4 and the
+        #     ADMIN_TOTAL_CPU_QUOTA=32 envelope, so it cannot be
+        #     legitimate state).
+        # box_last_activity / ssh_access cascade-delete via FK.
         run: |
           set -euo pipefail
           CLUSTER="${{ steps.resources.outputs.cluster }}"
@@ -271,15 +282,15 @@ jobs:
                 if [ "$TD" = "$PRIMARY_TD" ]; then echo "$arn"; break; fi
             done)
           [ -n "$TASK" ] || { echo "::error::No Api task on PRIMARY deployment"; exit 1; }
-          SQL='DELETE FROM "box" WHERE "name" = '\''e2e-test-box'\'' AND "organizationId" = (SELECT "organizationId" FROM "organization_user" WHERE "userId" = '\''boxlite-admin'\'' AND "isDefaultForUser" = true LIMIT 1); SELECT count(*) FROM "box" WHERE "name" = '\''e2e-test-box'\'' AND "organizationId" = (SELECT "organizationId" FROM "organization_user" WHERE "userId" = '\''boxlite-admin'\'' AND "isDefaultForUser" = true LIMIT 1);'
+          SQL='DELETE FROM "box" WHERE "organizationId" = (SELECT "organizationId" FROM "organization_user" WHERE "userId" = '\''boxlite-admin'\'' AND "isDefaultForUser" = true LIMIT 1) AND ("name" = '\''e2e-test-box'\'' OR "cpu" = 999); SELECT count(*) FROM "box" WHERE "organizationId" = (SELECT "organizationId" FROM "organization_user" WHERE "userId" = '\''boxlite-admin'\'' AND "isDefaultForUser" = true LIMIT 1) AND ("name" = '\''e2e-test-box'\'' OR "cpu" = 999);'
           SQL_B64=$(printf '%s' "$SQL" | base64 -w0)
           OUT=/tmp/ecs_purge.log
           aws ecs execute-command --cluster "$CLUSTER" --task "$TASK" --container Api --interactive \
             --command "sh -c \"echo ${SQL_B64} | base64 -d | PAGER=cat PGPASSWORD=\\\"\\\$DB_PASSWORD\\\" psql -h \\\"\\\$DB_HOST\\\" -U \\\"\\\$DB_USERNAME\\\" -d \\\"\\\$DB_DATABASE\\\" -A -t -P pager=off -v ON_ERROR_STOP=1 -f -\"" \
             2>&1 | tee "$OUT"
-          # Post-purge: zero rows with the fixture name on this org.
+          # Post-purge: zero rows matching the wipe predicate on this org.
           tr -d '\r' < "$OUT" | grep -E '^0$' \
-            || { echo "::error::post-purge SELECT count for e2e-test-box did not show 0"; exit 1; }
+            || { echo "::error::post-purge SELECT count did not show 0"; exit 1; }
 
       # ──────────────────────────────────────────────────────────────────
       # Build SDK from THIS checkout (path_prefix and other source-tree

.gitignore

@@ -179,6 +179,7 @@ Cargo.lock
 .claude/scheduled_tasks.lock
 .claude/worktrees/
 .claude/.last-audit.json
+.claude/.pr-reviewed.json
 
 # ============================================================================
 # Local dev artifacts (apps/infra-local + dashboard E2E session)

scripts/test/e2e/cases/test_error_code_mapping.py

@@ -33,6 +33,8 @@
 import boxlite
 import pytest
 
+from conftest import DEFAULT_IMAGE
+
 
 def _profile() -> dict:
     return tomllib.loads((Path.home() / ".boxlite/credentials.toml").read_text())[
@@ -113,7 +115,7 @@ async def test_invalid_argument_zero_cpu_returns_400(rt):
     status, body = _api_call(
         "POST",
         f"/v1/{p['path_prefix']}/boxes",
-        {"image": "alpine:3.23", "cpus": 0, "memory_mib": 256, "disk_size_gb": 4},
+        {"image": DEFAULT_IMAGE, "cpus": 0, "memory_mib": 256, "disk_size_gb": 4},
     )
     _assert_http_code(
         status,
@@ -141,7 +143,7 @@ async def test_invalid_argument_negative_memory_returns_400(rt):
     status, body = _api_call(
         "POST",
         f"/v1/{p['path_prefix']}/boxes",
-        {"image": "alpine:3.23", "cpus": 1, "memory_mib": -1, "disk_size_gb": 4},
+        {"image": DEFAULT_IMAGE, "cpus": 1, "memory_mib": -1, "disk_size_gb": 4},
     )
     _assert_http_code(
         status,
@@ -254,7 +256,7 @@ async def test_resource_exhausted_over_cpu_quota_returns_429(rt):
     status, body = _api_call(
         "POST",
         f"/v1/{p['path_prefix']}/boxes",
-        {"image": "alpine:3.23", "cpus": 999, "memory_mib": 256, "disk_size_gb": 4},
+        {"image": DEFAULT_IMAGE, "cpus": 999, "memory_mib": 256, "disk_size_gb": 4},
     )
     # The mapping says 429 ResourceExhausted; some implementations may also
     # 400 InvalidArgument (treating it as a parse-time validation failure).

scripts/test/e2e/cases/test_lifecycle.py

@@ -30,9 +30,15 @@ async def test_create_generates_unique_ids(rt, image):
     b = await rt.create(boxlite.BoxOptions(image=image, auto_remove=True))
     try:
         assert a.id != b.id
-        # uuid v4 format check
-        assert len(a.id.split("-")) == 5
-        assert len(b.id.split("-")) == 5
+        # Post-#735 box ids are 12-char alphanumeric (BOX_ID_REGEX in
+        # apps/api/src/box/utils/box-id.util.ts) — no longer the
+        # 5-segment uuid format the pre-collapse SDK was returning.
+        import re
+        for box_id in (a.id, b.id):
+            assert re.fullmatch(r"[0-9A-Za-z]{12}", box_id), (
+                f"box id {box_id!r} doesn't match the post-#735 "
+                f"12-char alphanumeric BOX_ID_REGEX"
+            )
     finally:
         await rt.remove(a.id, force=True)
         await rt.remove(b.id, force=True)

scripts/test/e2e/cases/test_path_verification.py

@@ -18,6 +18,7 @@
 """
 from __future__ import annotations
 
+import os
 import sys
 from pathlib import Path
 
@@ -28,6 +29,25 @@
 from path_verification import runner_journal_seek, runner_hits_for_box
 from conftest import drain
 
+# Both cases in this file are LOCAL-only meta-tests:
+#   (1) inspects ~/.boxlite/credentials for url=':3000' — only true for
+#       the local-bootstrap profile, never for a cloud profile pointing at
+#       the ELB DNS.
+#   (2) reads the local boxlite-runner systemd journal via journalctl —
+#       on the Tokyo cloud profile p1 the runner journal lives on an
+#       EC2 instance the test client can't reach.
+# Skip the whole module when the test session is configured against
+# anything other than the default (= local) profile so these don't
+# spam the cloud failure tally with environment-mismatch noise.
+pytestmark = pytest.mark.skipif(
+    os.environ.get("BOXLITE_E2E_PROFILE", "default") != "default",
+    reason=(
+        "LOCAL-only meta-test (checks credentials.toml url=:3000 and "
+        "reads host's boxlite-runner journalctl). Cannot run against a "
+        "remote profile."
+    ),
+)
+
 
 @pytest.mark.asyncio
 async def test_sdk_runtime_is_rest_against_local_api(rt):

scripts/test/e2e/cases/test_quota_enforcement.py

@@ -37,6 +37,8 @@
 
 import pytest
 
+from conftest import DEFAULT_IMAGE
+
 pytestmark = pytest.mark.xfail(
     strict=True,
     reason=(
@@ -94,7 +96,7 @@ def _delete_box(box_id: str) -> None:
 async def test_cpus_above_per_box_limit_returns_4xx():
     """cpus far above max_cpu_per_box (4) → 429 or 400, not 5xx."""
     status, body = _post_box(
-        {"image": "alpine:3.23", "cpus": 999, "memory_mib": 256, "disk_size_gb": 4}
+        {"image": DEFAULT_IMAGE, "cpus": 999, "memory_mib": 256, "disk_size_gb": 4}
     )
     body_str = json.dumps(body) if body else ""
     assert 400 <= status < 500, f"cpus=999 leaked HTTP {status}: {body_str}"
@@ -105,7 +107,7 @@ async def test_memory_above_per_box_limit_returns_4xx():
     """memory far above max_memory_per_box (8 GiB) → 4xx, not 5xx."""
     status, body = _post_box(
         {
-            "image": "alpine:3.23",
+            "image": DEFAULT_IMAGE,
             "cpus": 1,
             "memory_mib": 8_192_000_000,
             "disk_size_gb": 4,
@@ -120,7 +122,7 @@ async def test_disk_above_per_box_limit_returns_4xx():
     """disk far above max_disk_per_box (20 GiB) → 4xx, not 5xx."""
     status, body = _post_box(
         {
-            "image": "alpine:3.23",
+            "image": DEFAULT_IMAGE,
             "cpus": 1,
             "memory_mib": 256,
             "disk_size_gb": 99_999_999,
@@ -136,7 +138,7 @@ async def test_quota_violation_does_not_silently_create_box(rt):
     immediately and find an orphan with cpus=999, the runner accepted the
     doomed request and the quota check is decorative."""
     status, body = _post_box(
-        {"image": "alpine:3.23", "cpus": 999, "memory_mib": 256, "disk_size_gb": 4}
+        {"image": DEFAULT_IMAGE, "cpus": 999, "memory_mib": 256, "disk_size_gb": 4}
     )
     if 200 <= status < 300:
         pytest.fail(f"cpus=999 unexpectedly succeeded: HTTP {status}, body={body}")
@@ -158,7 +160,7 @@ async def test_quota_zero_cpus_returns_4xx():
     """cpus=0 — boundary at the other end. Must be 4xx, not 500 or a box
     that immediately crashes."""
     status, body = _post_box(
-        {"image": "alpine:3.23", "cpus": 0, "memory_mib": 256, "disk_size_gb": 4}
+        {"image": DEFAULT_IMAGE, "cpus": 0, "memory_mib": 256, "disk_size_gb": 4}
     )
     body_str = json.dumps(body) if body else ""
     assert 400 <= status < 500, f"cpus=0 leaked HTTP {status}: {body_str}"