feat(api,ui): showcase-completion E6 — export bundle mvp (#412)

[w7-mgfcode]

Summary

Implements E6 of the showcase-completion initiative (umbrella #406, epic #412): an export-only bundle surface for saved showcase workspaces.

POST /demo/workspaces/{workspace_id}/export writes a self-describing, checksum-validated bundle under artifacts/showcase/<workspace_id>/:

artifacts/showcase/<workspace_id>/
├── manifest.json          # versioned snapshot + model-run references
├── scenario_plans/<id>.json
└── checksums.sha256        # sha256sum-compatible; covers every other file

The Saved-workspaces panel gains a per-row Export button. Import/restore is explicitly out of scope for this umbrella; model artifacts are referenced (uri + registry hash + live verify), never copied. No migration, no DB writes — export is stateless and re-runnable.

What's in scope

• Vertical slice: all backend changes inside app/features/demo/ (+ one Settings field + one .env.example line). Soft references (winning_run_id / v2_run_id / stale_alias_run_id / scenario_plan_ids) resolve over the in-process httpx.ASGITransport surface — no cross-slice imports.
• Path safety: traversal guard mirrors LocalFSProvider._resolve_path (resolve() + relative_to(root)), reimplemented in the slice; rmtree target is always the guarded resolution; workspace_id comes from the DB row, never the raw path.
• Checksums: chunked SHA-256, sha256sum-compatible format, excludes itself; the endpoint re-reads + recomputes every hash before returning (validated).
• Errors: RFC 7807 — 404 missing, 409 while status="running", 500 on disk failure. Dangling refs → unresolved_references (export still 200). Re-export overwrites deterministically.

Decisions (frozen)

One dir per workspace_id; re-export = overwrite; references resolved over in-process HTTP; artifacts referenced not copied; stateless (no DB writes); failed exportable / running→409; checksums.sha256 excludes itself; new SHOWCASE_EXPORT_ROOT setting. No story slot written, no config_schema_version bump (E1 Decision 5).

Validation

• ✅ ruff + ruff format · mypy --strict (0) · pyright --strict (0 errors)
• ✅ pytest -m "not integration" — 2112 passed (incl. new test_export.py + route 404/409/200)
• ✅ demo-slice integration — 9 passed (real Postgres: round-trip, overwrite, dangling ref, 409)
• ✅ frontend — 461 vitest pass, eslint 0 errors, tsc -b no NEW errors vs dev baseline
• ✅ manual — real coreutils sha256sum -c checksums.sha256 OK · real-HTTP export OK · Export button dogfooded in a browser (success toast verified)

Files

New: app/features/demo/export.py, app/features/demo/tests/test_export.py
Modified: routes.py, schemas.py, app/core/config.py, .env.example, tests/test_routes.py, frontend/{WorkspacePanel.tsx, WorkspacePanel.test.tsx, hooks/use-workspaces.ts, types/api.ts}, docs/_base/{API_CONTRACTS.md, RUNBOOKS.md}

Closes #412.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @w7-mgfcode, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1169bd5e-abbe-433c-9583-fe813069e449

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/showcase-completion-e6-export-bundle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}