feat(service): Add optional Warden backing service

[gricha]

Add an optional backing service for durable Warden run history, cost analysis, finding exploration, and repository-scoped memory.

The service is API-first and self-hostable. It provides a strict versioned ingestion contract, authenticated read APIs, service credentials, read-only personal tokens, and Junior-style Google OAuth for browser access. The reference app deploys to Vercel using Node functions, static dashboard assets, Marketplace Postgres, and Vercel Cron without Redis or an always-on worker.

Warden's CLI, GitHub Action, and SDK publish and recall through fail-open boundaries. A repository without a configured service behaves as it does today. Once a URL and token are configured, the client defaults to the findings profile with memory enabled while continuing to treat local JSONL, Action output, and SDK results as authoritative.

The change also includes replay, migrations, credential administration, retention and deletion boundaries, durable Postgres jobs, deployment documentation, and a compact API-backed dashboard. Passive memory candidates remain inactive by default; automatic promotion requires a separate explicit policy.

The auth scope, profile-redaction boundary, idempotent ingestion transaction, and serverless job leasing are the most important review surfaces.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a22c1cd. Configure here.}

[sentry-warden]

recallActionMemoryFailOpen silently drops repository memory when >500 files change

recallActionMemoryFailOpen sends the full changed-file list to the memory endpoint without truncating to the service's 500-item limit, so large pull requests silently forfeit recalled memories.

Evidence

• MemoryRecallRequestSchema in the service API package defines paths: z.array(z.string().max(1_024)).max(500) (api.ts).
• fetchPullRequestFiles in the event layer uses octokit.paginate and returns every changed file without truncation (event/context.ts).
• recallActionMemoryFailOpen builds paths from context.pullRequest?.files.map(file => file.filename) and passes it directly to recallMemoryFailOpen (service.ts:31-43).
• recallMemoryFailOpen delegates to createWardenServiceClient(...).recallMemory, which parses the request with MemoryRecallRequestSchema.parse; an oversized array throws a ZodError that is caught and returned as undefined (client.ts).
• recallActionMemoryFailOpen then returns { memories: [] }, so the action proceeds without the expected historical context.

_{Identified by Warden · code-review · JXP-X2L}

[sentry-warden]

Empty or whitespace-only finding fields silently break service envelope construction

findingRecord slices title, description, and path strings to max length but does not trim them or filter empty/whitespace-only values. Optional fields like verification and language also pass through whitespace-only strings because they are truthy in JavaScript. These values satisfy Warden's local FindingSchema but violate the service ShortTextSchema, DescriptionSchema, and PathSchema, which require z.string().trim().min(1). When buildServiceRunEnvelope later calls redactRunProjection, RunProjectionSchema.parse throws a ZodError; callers catch it and either skip service publication or, during CLI replay, emit the misleading error "Artifact is not a supported completed JSONL or findings-output file."

Evidence

• FindingSchema.title is z.string() (no .min(1)) and validateFindings in sdk/extract.ts does not reject empty strings, so empty titles can reach findingRecord.
• service/findings.ts:21-30 already uses boundedOptionalText to normalize PR metadata for the exact same service contract, showing the codebase already handles this pattern for service-facing data.
• packages/warden-service-api/src/protocol.ts defines ShortTextSchema, DescriptionSchema, and PathSchema with .trim().min(1).
• packages/warden-service-api/src/redaction.ts calls RunProjectionSchema.parse(), which throws when empty/whitespace-only strings appear in those fields.
• In projection.ts lines 98-99, title and description are unconditionally included via .slice(0, MAX) with no empty-string guard, and optional fields at lines 101, 106, 110, 118-119 include whitespace-only strings because ...(value ? {...} : {}) treats ' ' as truthy.

_{Identified by Warden · code-review · ZCJ-85H}