fix: require genuine live hosting evidence

fix: validate complete immutable release surface
fix: verify hosting response content types
2026-07-25 22:25:04 +09:00 · 2026-07-25 21:45:02 +09:00 · 2026-07-25 21:43:55 +09:00
40 changed files with 218 additions and 2305 deletions
@@ -1,189 +0,0 @@
 name: frontend-quality-gates
 on:
  push:
    branches: [develop]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:
    inputs:
      stage:
        description: Highest promotion tier to evaluate
        required: true
        default: merge
        type: choice
        options:
          - merge
          - release
          - production
          - field
          - documentation
 env:
  NODE_VERSION: "24"
 jobs:
  merge_gate:
    name: ${{ matrix.gate }} / ${{ matrix.name }}
    if: ${{ gitea.event_name != 'workflow_dispatch' || inputs.stage != 'documentation' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { gate: FE-GATE-001, name: manifest-lockfile, browser: false }
          - { gate: FE-GATE-002, name: lint, browser: false }
          - { gate: FE-GATE-003, name: typecheck, browser: false }
          - { gate: FE-GATE-004, name: runtime-schema, browser: false }
          - { gate: FE-GATE-005, name: unit, browser: false }
          - { gate: FE-GATE-006, name: component, browser: false }
          - { gate: FE-GATE-007, name: integration, browser: false }
          - { gate: FE-GATE-008, name: e2e, browser: true }
          - { gate: FE-GATE-009, name: accessibility, browser: true }
          - { gate: FE-GATE-010, name: architecture, browser: false }
          - { gate: FE-GATE-011, name: build, browser: false }
          - { gate: FE-GATE-013, name: security, browser: false }
          - { gate: FE-GATE-020, name: sample-removal, browser: false }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Frozen install
        run: |
          corepack enable
          corepack pnpm install --frozen-lockfile
      - name: Install Chromium
        if: ${{ matrix.browser }}
        run: corepack pnpm exec playwright install --with-deps chromium
      - name: Run blocking gate
        run: corepack pnpm ci:gate -- ${{ matrix.gate }}
      - name: Upload gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.gate }}-${{ gitea.run_id }}
          path: artifacts/
          if-no-files-found: warn
  release_gate:
    name: ${{ matrix.gate }} / ${{ matrix.name }}
    needs: merge_gate
    if: ${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
    runs-on: ubuntu-latest
    env:
      HOSTING_BASE_URL: ${{ vars.HOSTING_BASE_URL }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { gate: FE-GATE-012, name: bundle, browser: false }
          - { gate: FE-GATE-014, name: config-compatibility, browser: false }
          - { gate: FE-GATE-015, name: release-coherence, browser: false }
          - { gate: FE-GATE-019, name: hosting-header, browser: false }
          - { gate: FE-GATE-026, name: lab-performance, browser: true }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Frozen install
        run: |
          corepack enable
          corepack pnpm install --frozen-lockfile
      - name: Install Chromium
        if: ${{ matrix.browser }}
        run: corepack pnpm exec playwright install --with-deps chromium
      - name: Run blocking gate
        run: corepack pnpm ci:gate -- ${{ matrix.gate }}
      - name: Upload gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.gate }}-${{ gitea.run_id }}
          path: artifacts/
          if-no-files-found: warn
  production_gate:
    name: ${{ matrix.gate }} / ${{ matrix.name }}
    needs: release_gate
    if: ${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { gate: FE-GATE-016, name: rollback-drill }
          - { gate: FE-GATE-021, name: runbook-boot-config }
          - { gate: FE-GATE-022, name: runbook-chunk-mismatch }
          - { gate: FE-GATE-023, name: runbook-api-degradation }
          - { gate: FE-GATE-024, name: runbook-telemetry }
          - { gate: FE-GATE-025, name: runbook-release-rollback }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Frozen install
        run: |
          corepack enable
          corepack pnpm install --frozen-lockfile
      - name: Run blocking gate
        run: corepack pnpm ci:gate -- ${{ matrix.gate }}
      - name: Upload gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.gate }}-${{ gitea.run_id }}
          path: artifacts/
          if-no-files-found: warn
  field_gate:
    name: FE-GATE-018 / field-web-vitals
    needs: production_gate
    if: ${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'field' }}
    runs-on: ubuntu-latest
    env:
      FIELD_WEB_VITALS_INPUT: ${{ vars.FIELD_WEB_VITALS_INPUT }}
      MIN_ELIGIBLE_SAMPLES: ${{ vars.MIN_ELIGIBLE_SAMPLES }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Frozen install
        run: |
          corepack enable
          corepack pnpm install --frozen-lockfile
      - name: Run blocking gate
        run: corepack pnpm ci:gate -- FE-GATE-018
      - name: Upload gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: FE-GATE-018-${{ gitea.run_id }}
          path: artifacts/
          if-no-files-found: warn
  documentation_gate:
    name: FE-GATE-017 / diagram-review
    if: ${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'documentation' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Frozen install
        run: |
          corepack enable
          corepack pnpm install --frozen-lockfile
      - name: Run documentation gate
        run: corepack pnpm ci:gate -- FE-GATE-017
      - name: Upload gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: FE-GATE-017-${{ gitea.run_id }}
          path: artifacts/
          if-no-files-found: warn
@@ -1,77 +1,2 @@
-# Clean Architecture Frontend Template
+# clean-architecture-frontend-template
 A React/Vite reference implementation where architecture boundaries,
 integration behavior, release coherence, accessibility, performance, and
 operations are executable contracts rather than conventions.
 ## Start locally
 Requirements: Node 24 and Corepack. The repository pins pnpm in `package.json`.
 ```bash
 corepack pnpm install --frozen-lockfile
 corepack pnpm dev
 ```
 Runtime-public settings live in `public/config.json` and are validated before
 the product tree mounts. Client secrets are forbidden.
 ## Architecture
 Dependencies point inward:
 ```text
 presentation -> application -> domain
 adapters -----^
 bootstrap composes concrete adapters
 contracts own cross-cutting registries
 ```
 See `docs/architecture/overview.md` and `docs/architecture/layers.md`. The
 removable sample slice is under `src/sample/contract-fixture`; product code is
 not allowed to import it.
 ## Verification
 Common local checks:
 ```bash
 corepack pnpm lint
 corepack pnpm check:types
 corepack pnpm check:architecture
 corepack pnpm test:all
 corepack pnpm test:e2e
 corepack pnpm test:a11y
 corepack pnpm build
 corepack pnpm check:bundle
 corepack pnpm test:performance
 corepack pnpm verify:compatibility
 corepack pnpm verify:release
 corepack pnpm check:registries
 corepack pnpm drill:runbooks
 corepack pnpm check:ci
 ```
 Two gates intentionally need external evidence:
 - `review:a11y-manual` needs a signed human keyboard/focus/screen-reader review.
 - `collect:web-vitals-evidence` stays `FAIL_UNVERIFIED` until a reviewed minimum
  eligible-sample threshold and 28 days of production data exist.
 Live release verification additionally requires `HOSTING_BASE_URL`.
 ## CI and evidence
 The 26-gate registry is `config/ci/gates.json`; the Gitea workflow is
 `.gitea/workflows/quality-gates.yml`. It follows:
 ```text
 MERGE_READY -> RELEASE_READY -> PROD_PROMOTION_READY -> FIELD_SLO_READY
 ```
 `DOCUMENTATION_READY` is independent. No gate is downgraded to a warning.
 Machine-readable evidence is written below `artifacts/`; generated evidence is
 ignored by Git while `.gitkeep` files preserve the taxonomy.
 Operational details are in `docs/operations/`, with incident procedures in
 `docs/runbooks/`.
@@ -1,342 +0,0 @@
 {
  "schemaVersion": 1,
  "providerAdapter": ".gitea/workflows/quality-gates.yml",
  "stages": {
    "merge": {
      "readiness": "MERGE_READY",
      "needs": null,
      "gates": [
        "FE-GATE-001",
        "FE-GATE-002",
        "FE-GATE-003",
        "FE-GATE-004",
        "FE-GATE-005",
        "FE-GATE-006",
        "FE-GATE-007",
        "FE-GATE-008",
        "FE-GATE-009",
        "FE-GATE-010",
        "FE-GATE-011",
        "FE-GATE-013",
        "FE-GATE-020"
      ]
    },
    "release": {
      "readiness": "RELEASE_READY",
      "needs": "merge",
      "gates": [
        "FE-GATE-012",
        "FE-GATE-014",
        "FE-GATE-015",
        "FE-GATE-019",
        "FE-GATE-026"
      ]
    },
    "production": {
      "readiness": "PROD_PROMOTION_READY",
      "needs": "release",
      "gates": [
        "FE-GATE-016",
        "FE-GATE-021",
        "FE-GATE-022",
        "FE-GATE-023",
        "FE-GATE-024",
        "FE-GATE-025"
      ]
    },
    "field": {
      "readiness": "FIELD_SLO_READY",
      "needs": "production",
      "gates": ["FE-GATE-018"]
    },
    "documentation": {
      "readiness": "DOCUMENTATION_READY",
      "needs": null,
      "gates": ["FE-GATE-017"]
    }
  },
  "gates": {
    "FE-GATE-001": {
      "name": "manifest-lockfile",
      "steps": [{ "script": "verify:lockfile", "expect": "pass" }],
      "logPath": "artifacts/quality/install.txt",
      "evidence": ["artifacts/quality/install.txt"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-002": {
      "name": "lint",
      "steps": [{ "script": "lint", "expect": "pass" }],
      "logPath": "artifacts/quality/lint.txt",
      "evidence": ["artifacts/quality/lint.txt"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-003": {
      "name": "typecheck",
      "steps": [
        { "script": "check:types", "expect": "pass" },
        { "script": "check:types:fixture", "expect": "fail" }
      ],
      "logPath": "artifacts/quality/check-types.txt",
      "evidence": ["artifacts/quality/check-types.txt"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-004": {
      "name": "runtime-schema",
      "steps": [{ "script": "test:runtime-schema", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-004.txt",
      "evidence": ["artifacts/tests/runtime-schema.xml"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-005": {
      "name": "unit",
      "steps": [{ "script": "test:unit", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-005.txt",
      "evidence": ["artifacts/tests/unit.xml"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-006": {
      "name": "component",
      "steps": [{ "script": "test:component", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-006.txt",
      "evidence": ["artifacts/tests/component.xml"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-007": {
      "name": "integration",
      "steps": [{ "script": "test:integration", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-007.txt",
      "evidence": ["artifacts/tests/integration.xml"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-008": {
      "name": "e2e",
      "steps": [{ "script": "test:e2e", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-008.txt",
      "evidence": ["artifacts/tests/e2e/report/index.html"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-009": {
      "name": "accessibility",
      "steps": [
        { "script": "test:a11y", "expect": "pass" },
        { "script": "review:a11y-manual", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-009.txt",
      "evidence": [
        "artifacts/tests/a11y.json",
        "artifacts/tests/a11y-manual/APP_HOME.md",
        "artifacts/tests/a11y-manual/SAMPLE_RESOURCE_LIST.md",
        "artifacts/tests/a11y-manual/NOT_FOUND.md",
        "artifacts/tests/a11y-manual/report.json"
      ],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-010": {
      "name": "architecture",
      "steps": [{ "script": "check:architecture", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-010.txt",
      "evidence": ["artifacts/quality/dependency-report.json"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-011": {
      "name": "build",
      "steps": [{ "script": "build", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-011.txt",
      "evidence": ["artifacts/release/build-manifest.json"],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-012": {
      "name": "bundle",
      "steps": [
        { "script": "build", "expect": "pass" },
        { "script": "check:bundle", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-012.txt",
      "evidence": ["artifacts/performance/bundle.json"],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-013": {
      "name": "security",
      "steps": [
        { "script": "build:release", "expect": "pass" },
        { "script": "check:browser-security", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-013.txt",
      "evidence": [
        "artifacts/security/scan.sarif",
        "artifacts/release/dependency-inventory.json",
        "artifacts/security/dependency-diff.json"
      ],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-014": {
      "name": "config-compatibility",
      "steps": [{ "script": "verify:compatibility", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-014.txt",
      "evidence": ["artifacts/release/compatibility.json"],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-015": {
      "name": "release-coherence",
      "steps": [
        { "script": "build", "expect": "pass" },
        { "script": "verify:release", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-015.txt",
      "evidence": ["artifacts/release/verification.json"],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-016": {
      "name": "rollback-drill",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-005"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-016.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-005/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-017": {
      "name": "diagram-review",
      "steps": [{ "script": "verify:documentation", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-017.txt",
      "evidence": ["artifacts/quality/documentation-review.json"],
      "retentionClass": "documentation"
    },
    "FE-GATE-018": {
      "name": "field-web-vitals",
      "requiresEnvironment": [
        "FIELD_WEB_VITALS_INPUT",
        "MIN_ELIGIBLE_SAMPLES"
      ],
      "steps": [
        { "script": "collect:web-vitals-evidence", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-018.txt",
      "evidence": ["artifacts/performance/field-web-vitals.json"],
      "retentionClass": "field"
    },
    "FE-GATE-019": {
      "name": "hosting-header",
      "requiresEnvironment": ["HOSTING_BASE_URL"],
      "steps": [
        { "script": "build", "expect": "pass" },
        { "script": "verify:hosting-headers", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-019.txt",
      "evidence": ["artifacts/release/hosting-headers.json"],
      "retentionClass": "release-coherence"
    },
    "FE-GATE-020": {
      "name": "sample-removal",
      "steps": [{ "script": "test:sample-removal", "expect": "pass" }],
      "logPath": "artifacts/quality/gates/FE-GATE-020.txt",
      "evidence": ["artifacts/tests/sample-removal.xml"],
      "retentionClass": "merge-cycle"
    },
    "FE-GATE-021": {
      "name": "runbook-boot-config",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-001"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-021.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-001/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-022": {
      "name": "runbook-chunk-mismatch",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-002"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-022.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-002/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-023": {
      "name": "runbook-api-degradation",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-003"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-023.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-003/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-024": {
      "name": "runbook-telemetry",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-004"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-024.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-004/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-025": {
      "name": "runbook-release-rollback",
      "steps": [
        { "script": "build", "expect": "pass" },
        {
          "script": "drill:runbook",
          "args": ["--", "FE-RB-005"],
          "expect": "pass"
        }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-025.txt",
      "evidence": [
        "artifacts/runbooks/FE-RB-005/local-release/record.json"
      ],
      "retentionClass": "prod-drill"
    },
    "FE-GATE-026": {
      "name": "lab-performance",
      "steps": [
        { "script": "build", "expect": "pass" },
        { "script": "test:performance", "expect": "pass" }
      ],
      "logPath": "artifacts/quality/gates/FE-GATE-026.txt",
      "evidence": ["artifacts/performance/lab.json"],
      "retentionClass": "release-coherence"
    }
  },
  "retention": {
    "durationStatus": "UNSUPPORTED_PENDING_ORGANIZATION_POLICY",
    "merge-cycle": "at least through pull-request readiness decision",
    "release-coherence": "at least until the next release is promoted",
    "prod-drill": "at least until the next production promotion decision",
    "field": "through the 28-day window and aggregation",
    "documentation": "through documentation readiness review"
  }
 }
@@ -4,21 +4,25 @@
    "index": {
      "path": "/",
      "cacheControl": "no-cache",
      "contentTypes": ["text/html"],
      "securityHeaders": true
    },
    "runtimeConfig": {
      "path": "/config.json",
      "cacheControl": "no-store",
      "contentTypes": ["application/json"],
      "securityHeaders": true
    },
    "releaseManifest": {
      "path": "/release-manifest.json",
      "cacheControl": "no-store",
      "contentTypes": ["application/json"],
      "securityHeaders": true
    },
    "hashedAsset": {
      "pathPattern": "/assets/*",
      "cacheControl": "public, max-age=31536000, immutable",
      "contentTypes": ["text/javascript", "application/javascript"],
      "securityHeaders": false
    },
    "sourceMap": {
@@ -3,6 +3,7 @@
  "responses": {
    "index": {
      "cache-control": "no-cache",
      "content-type": "text/html; charset=utf-8",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
@@ -12,6 +13,7 @@
    },
    "runtimeConfig": {
      "cache-control": "no-store",
      "content-type": "application/json; charset=utf-8",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
@@ -21,6 +23,7 @@
    },
    "releaseManifest": {
      "cache-control": "no-store",
      "content-type": "application/json; charset=utf-8",
      "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "x-frame-options": "DENY",
@@ -29,7 +32,8 @@
      "permissions-policy": "camera=(), microphone=(), geolocation=()"
    },
    "hashedAsset": {
-      "cache-control": "public, max-age=31536000, immutable"
+      "cache-control": "public, max-age=31536000, immutable",
      "content-type": "text/javascript; charset=utf-8"
    }
  }
 }
@@ -1,18 +0,0 @@
 {
  "schemaVersion": 1,
  "bundle": {
    "initialJsGzipBytes": 204800,
    "lazyChunkGzipBytes": 122880
  },
  "lab": {
    "lcpMs": 2500,
    "cls": 0.1,
    "namedInteractionMs": 200
  },
  "field": {
    "p75LcpMs": 2500,
    "p75Cls": 0.1,
    "p75InpMs": 200,
    "minimumEligibleSamples": null
  }
 }
@@ -1,5 +0,0 @@
 {
  "schemaVersion": 1,
  "releaseId": "local-release",
  "samples": []
 }
@@ -1,93 +0,0 @@
 {
  "schemaVersion": 1,
  "runbooks": {
    "FE-RB-001": {
      "title": "Boot configuration failure",
      "gateId": "FE-GATE-021",
      "triggerKinds": ["BOOT_CONFIG_FAILURE"],
      "containment": "stop product route mount, show the safe support shell, and refetch at most once",
      "window": "owner triage planned-default 5m",
      "escalation": ["env-config owner", "release owner"],
      "recoveryEvidence": [
        "clean-session boot",
        "product root mount",
        "config validation",
        "no repeated boot error"
      ],
      "negativeFixture": "a valid config followed by an injected mount failure must fail recovery"
    },
    "FE-RB-002": {
      "title": "Chunk, manifest, or deployment mismatch",
      "gateId": "FE-GATE-022",
      "triggerKinds": [
        "CHUNK_LOAD_FAILURE",
        "RELEASE_MANIFEST_FAILURE",
        "DEPLOY_MISMATCH"
      ],
      "containment": "warn for dirty state, fetch manifest no-store once, and allow one guarded reload",
      "window": "release owner triage planned-default 5m",
      "escalation": ["release-cache owner", "hosting/CDN owner"],
      "recoveryEvidence": [
        "entry and lazy assets reachable",
        "release tuple coherent",
        "second reload blocked",
        "critical route smoke"
      ],
      "negativeFixture": "a second failure for the same release pair must not reload"
    },
    "FE-RB-003": {
      "title": "Backend API degradation",
      "gateId": "FE-GATE-023",
      "triggerKinds": [
        "TERMINAL_NETWORK_RATE",
        "REQUEST_TIMEOUT_RATE",
        "SERVER_FAILURE_RATE",
        "SCHEMA_MISMATCH"
      ],
      "containment": "do not expand retry caps, serve safe stale reads, and never retry an unkeyed mutation",
      "window": "rolling 5m trigger; first classification planned-default 10m",
      "escalation": [
        "api-client owner",
        "backend operation owner",
        "release compatibility owner"
      ],
      "recoveryEvidence": [
        "terminal failure rate at baseline",
        "no retry amplification",
        "critical read/write smoke",
        "schema fixtures"
      ],
      "negativeFixture": "an unkeyed POST receiving 503 must not retry"
    },
    "FE-RB-004": {
      "title": "Telemetry sink failure",
      "gateId": "FE-GATE-024",
      "triggerKinds": ["TELEMETRY_FAILURE"],
      "containment": "keep product flow available, bound the queue, and never report recursively to the failing sink",
      "window": "platform triage planned-default 15m",
      "escalation": ["observability owner", "telemetry platform owner"],
      "recoveryEvidence": [
        "product flow unaffected",
        "delivery self-check",
        "queue drained within bound",
        "forbidden attributes absent"
      ],
      "negativeFixture": "raw URL and query data must be removed from telemetry"
    },
    "FE-RB-005": {
      "title": "Coherent release rollback",
      "gateId": "FE-GATE-025",
      "triggerKinds": ["RELEASE_BLOCKING_DEFECT"],
      "containment": "select a prior immutable tuple, verify asset/config/API compatibility, atomically switch, and smoke",
      "window": "provider recovery target TBD",
      "escalation": ["release-cache owner", "release approver/hosting owner"],
      "recoveryEvidence": [
        "compatibility gate",
        "release coherence gate",
        "critical smoke",
        "release ID in incident timeline"
      ],
      "negativeFixture": "HTML build A with asset manifest B must be rejected"
    }
  }
 }
@@ -1,34 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-FIELD-WEB-VITALS@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "window",
    "context",
    "metrics",
    "eligibility",
    "status",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "window": { "type": "object", "required": ["days", "start", "end"] },
    "context": {
      "type": "object",
      "required": ["source", "network", "routeAggregation", "releaseId"]
    },
    "metrics": { "type": "object" },
    "eligibility": {
      "type": "object",
      "required": ["consentRequired", "eligibleSamples", "minimumEligibleSamples"]
    },
    "status": {
      "enum": ["PASS", "FAIL_THRESHOLD", "FAIL_UNVERIFIED"]
    },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,30 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-LAB@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "context",
    "metrics",
    "thresholds",
    "fixtures",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "context": {
      "type": "object",
      "required": ["runner", "browser", "viewport", "network", "cpu", "cache", "build"]
    },
    "metrics": {
      "type": "object",
      "required": ["lcpMs", "cls", "namedInteractionMs"]
    },
    "thresholds": { "type": "object" },
    "fixtures": { "type": "array", "minItems": 2 },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,42 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ART-FE-RUNBOOK-DRILL@1",
  "type": "object",
  "required": [
    "schemaVersion",
    "runbookId",
    "releaseId",
    "drillTimestamp",
    "triggerInjected",
    "triggerAsserted",
    "containmentAsserted",
    "escalationPathAsserted",
    "recoveryAssertions",
    "negativeFixtureFailedAsExpected",
    "windowObservedBucket",
    "passed"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "runbookId": { "pattern": "^FE-RB-00[1-5]$" },
    "releaseId": { "type": "string", "minLength": 1 },
    "drillTimestamp": { "type": "string", "format": "date-time" },
    "triggerInjected": { "type": "string" },
    "triggerAsserted": { "type": "boolean" },
    "containmentAsserted": { "type": "boolean" },
    "escalationPathAsserted": { "type": "boolean" },
    "recoveryAssertions": {
      "type": "array",
      "minItems": 4,
      "items": {
        "type": "object",
        "required": ["assertion", "evidence", "passed"]
      }
    },
    "negativeFixtureFailedAsExpected": { "type": "boolean" },
    "windowObservedBucket": { "type": "string" },
    "providerVerificationRequired": { "type": "boolean" },
    "passed": { "type": "boolean" }
  },
  "additionalProperties": false
 }
@@ -1,23 +0,0 @@
 # Architecture overview
 This Mermaid view is a repository-local implementation projection. The
 `PASS_SCOPED` reviewer evidence applies to the canonical draw.io diagram named
 in `review-ledger.json`, not automatically to edits in this file.
 ```mermaid
 flowchart LR
  Bootstrap[bootstrap / composition root] --> Presentation[presentation]
  Bootstrap --> Adapters[adapters]
  Presentation --> Application[application]
  Adapters --> Application
  Application --> Domain[domain]
  Contracts[contract registries] --> Bootstrap
  Contracts --> Adapters
  Contracts --> Presentation
 ```
 Dependencies point inward. Presentation calls application use cases, adapters
 implement application ports, and only the composition root selects concrete
 adapters. Contract registries are the single named source for routes, API
 operations, environment values, storage keys, errors, queries, telemetry, and
 release tokens.
@@ -1,22 +0,0 @@
 # Imported scoped diagram review evidence
 This ledger entry consumes the canonical evidence already recorded by the
 `ca-skeleton-frontend-operational-contract` project note. It does not claim
 review of the repository-local Mermaid projections or of the complete
 production deployment topology.
 - Reviewer: `wiki-diagram-reviewer`
 - Standard: `rules/diagram-standards.md` v2
 - Canonical report:
  `docs/superpowers/specs/2026-07-18-ca-skeleton-frontend-operational-contract-review/diagram-review.md`
 - Canonical report SHA-256:
  `b4d2a35e4f07e176717786408f98dab5cee1047f77f6ff61f5faeddfccd78a29`
 | Canonical diagram | SHA-256 | Score | Verdict | Reviewed scope |
 | --- | --- | ---: | --- | --- |
 | `raw/diagrams/ca-skeleton-frontend/architecture-overview-2026-07-18.drawio` | `c0ae56c9c964c5c6e698ab7dcc91736b9b811b2b834381817905db81c4230ba0` | 100 | PASS | Clean Architecture compile-time dependency ownership |
 | `raw/diagrams/ca-skeleton-frontend/architecture-deployment-2026-07-18.drawio` | `9a654326fb840ddf24b832221ff7eec4b8fadd9f87ad84174fccfa3bfcd1a25b` | 100 | PASS | immutable static assets and mutable `/config.json` delivery |
 The canonical report explicitly limits this `PASS_SCOPED`: it does not verify
 the complete release/rollback topology, the implementation topology, or live
 hosting state.
@@ -1,29 +0,0 @@
 {
  "schemaVersion": 1,
  "status": "PASS_SCOPED",
  "reviewer": "wiki-diagram-reviewer",
  "standard": "rules/diagram-standards.md v2",
  "evidenceReport": {
    "repoPath": "docs/architecture/review-evidence.md",
    "canonicalPath": "docs/superpowers/specs/2026-07-18-ca-skeleton-frontend-operational-contract-review/diagram-review.md",
    "canonicalSha256": "b4d2a35e4f07e176717786408f98dab5cee1047f77f6ff61f5faeddfccd78a29"
  },
  "reviews": {
    "overview": {
      "sourcePath": "raw/diagrams/ca-skeleton-frontend/architecture-overview-2026-07-18.drawio",
      "sha256": "c0ae56c9c964c5c6e698ab7dcc91736b9b811b2b834381817905db81c4230ba0",
      "score": 100,
      "verdict": "PASS",
      "thresholdSatisfied": true,
      "scope": "Clean Architecture compile-time dependency ownership"
    },
    "staticDelivery": {
      "sourcePath": "raw/diagrams/ca-skeleton-frontend/architecture-deployment-2026-07-18.drawio",
      "sha256": "9a654326fb840ddf24b832221ff7eec4b8fadd9f87ad84174fccfa3bfcd1a25b",
      "score": 100,
      "verdict": "PASS",
      "thresholdSatisfied": true,
      "scope": "immutable static assets and mutable /config.json delivery"
    }
  }
 }
@@ -1,25 +0,0 @@
 # Static asset and runtime-config delivery
 This Mermaid view is a repository-local implementation projection. The
 `PASS_SCOPED` reviewer evidence applies only to the canonical static-delivery
 draw.io scope recorded in `review-ledger.json`.
 ```mermaid
 sequenceDiagram
  participant CI
  participant ImmutableRelease
  participant ActivePointer
  participant Browser
  CI->>ImmutableRelease: upload hashed assets
  CI->>ImmutableRelease: upload release manifest
  CI->>ImmutableRelease: upload runtime config
  CI->>ImmutableRelease: probe asset reachability
  CI->>ActivePointer: atomically switch HTML
  Browser->>ActivePointer: fetch revalidated HTML
  Browser->>ImmutableRelease: fetch no-store config and manifest
  Browser->>ImmutableRelease: fetch immutable hashed assets
  CI->>Browser: boot, route, API, and reload-loop smoke
 ```
 Rollback changes the active pointer only after confirming that the prior
 immutable release has a coherent HTML/assets/config/API/manifest tuple.
@@ -1,41 +0,0 @@
 # CI quality-gate orchestration
 `config/ci/gates.json` is the executable registry for all 26 gates. The Gitea
 adapter runs each gate as an independent matrix check with full fan-out and no
 soft-fail wiring.
 The dependency graph is:
 ```text
 MERGE_READY
  -> RELEASE_READY
    -> PROD_PROMOTION_READY
      -> FIELD_SLO_READY
 DOCUMENTATION_READY (off-chain)
 ```
 Pull requests and `develop` pushes evaluate merge readiness. Version tags
 evaluate merge then release readiness. Production and field evaluation require
 an explicit workflow dispatch. The field tier cannot pass until the 28-day
 sample threshold decision is recorded. Documentation readiness consumes the
 canonical project-note evidence in which both scoped diagrams already received
 100/100 `PASS_SCOPED`; the repo ledger preserves the evidence scope and
 canonical digests.
 All jobs upload the shared `artifacts/` tree even after failure. Numeric
 retention remains an organization/provider decision; the workflow intentionally
 does not invent `retention-days`. The relative minimums are recorded in the
 registry: merge evidence through the PR decision, coherent release evidence
 through the next release promotion, drill evidence through the next production
 promotion, and field evidence through aggregation.
 Repository variables required by higher tiers:
 - `HOSTING_BASE_URL` for live header verification
 - `FIELD_WEB_VITALS_INPUT` for the privacy-approved field sample document
 - `MIN_ELIGIBLE_SAMPLES` after the baseline decision
 Branch protection must mark each `FE-GATE-* / <name>` check required for its
 declared tier. This repository cannot configure server-side protection by
 committing a file.
@@ -1,17 +0,0 @@
 # Performance evidence contract
 Performance evidence is deliberately split by measurement context:
 - `bundle.json` records production build output and enforces initial JavaScript
  at 200 KiB gzip and every lazy chunk at 120 KiB gzip.
 - `lab.json` records Chromium/runner/viewport/network/CPU/cache/build context and
  enforces LCP 2.5 s, CLS 0.10, and the named route interaction at 200 ms.
 - `field-web-vitals.json` records consent-filtered, route-ID aggregated,
  release-specific production samples over 28 days and evaluates p75 LCP, CLS,
  and INP against 2.5 s, 0.10, and 200 ms.
 The field minimum eligible-sample threshold is intentionally unresolved until
 a privacy-approved telemetry baseline exists. Therefore the field command
 fails closed with `FAIL_UNVERIFIED` when run against the example input. Provide
 `FIELD_WEB_VITALS_INPUT` and a reviewed `MIN_ELIGIBLE_SAMPLES` only after that
 decision is recorded.
@@ -20,6 +20,13 @@ The provider-independent cache defaults are:
 - public source maps: disabled
 - service worker/offline cache: disabled
 HTML, JSON config/manifest, and hashed JavaScript MIME types are also compared
 to the declared allowlist; a cache-correct response with a mismatched
 `Content-Type` still fails the hosting gate.
 `corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
 Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
-requires the artifact to report `mode: "live"`.
+requires the artifact to report `mode: "live"`. The live target must be its
 canonical, non-loopback HTTPS root URL. Each required surface must return HTTP
 200 without leaving that origin before its cache, content-type, and security
 headers can count as deployment evidence.
@@ -1,9 +0,0 @@
 # FE-RB-001 — Boot configuration failure
 Trigger on `BOOT_CONFIG_FAILURE` after the single bounded refetch fails. Stop
 product route mounting and show the safe support shell; the planned owner
 triage target is five minutes. Escalate from the environment/config owner to
 the release owner.
 Close only after a clean-session boot mounts the product root, config
 validation evidence passes, and repeated boot-error telemetry is absent.
@@ -1,11 +0,0 @@
 # FE-RB-002 — Chunk or deployment mismatch
 Trigger on `CHUNK_LOAD_FAILURE`, `RELEASE_MANIFEST_FAILURE`, or
 `DEPLOY_MISMATCH`. Warn when dirty state may be lost, fetch the manifest
 `no-store` once, record the release pair, and allow only one reload. The
 planned release-owner triage target is five minutes. Escalate to the hosting/CDN
 owner.
 Close only after entry/lazy assets are reachable, the manifest parses into a
 coherent tuple, a second automatic reload is blocked, and the critical route
 smoke passes.
@@ -1,10 +0,0 @@
 # FE-RB-003 — Backend API degradation
 Trigger when terminal network/timeout/5xx failures exceed the rolling
 five-minute threshold or on one `SCHEMA_MISMATCH`. Do not expand client retry
 caps, do not retry schema mismatches, and never retry an unkeyed mutation.
 Escalate from the API client owner to backend operations and then release
 compatibility; the planned first-classification target is ten minutes.
 Close only after the failure rate returns to baseline, retry amplification is
 absent, critical read/write smoke passes, and schema fixtures pass.
@@ -1,9 +0,0 @@
 # FE-RB-004 — Telemetry sink failure
 Trigger on sink network/non-2xx errors, queue overflow, or adapter
 initialization failure. Keep product flows available, bound the queue, and do
 not recursively report to the failed sink. Escalate from observability to the
 telemetry platform owner; the planned triage target is fifteen minutes.
 Close only after product e2e remains unaffected, delivery self-check succeeds,
 the queue drains within its bound, and the forbidden-attribute scan passes.
@@ -1,13 +0,0 @@
 # FE-RB-005 — Coherent release rollback
 Trigger on a release-blocking boot, chunk, render, API, or security defect when
 a safe forward fix is not demonstrated inside the incident window. Select a
 prior immutable release, verify its asset/config/API tuple, atomically switch
 the complete set, perform the provider cache action, and run smoke checks.
 Escalate from the release-cache owner to the release approver/hosting owner.
 The provider recovery target remains TBD until hosting is selected.
 Close only when compatibility and release-coherence gates pass, critical smoke
 passes, repeated `DEPLOY_MISMATCH` is absent, and the incident timeline records
 the restored release ID. Pointer-switch or cache-purge completion alone is not
 recovery evidence.
@@ -33,15 +33,7 @@
    "check:registries": "node scripts/check-registries.mjs",
    "verify:compatibility": "node scripts/check-compatibility.mjs",
    "verify:release": "node scripts/verify-release.mjs",
-    "verify:hosting-headers": "node scripts/verify-hosting-headers.mjs",
+    "verify:hosting-headers": "node scripts/verify-hosting-headers.mjs"
    "check:bundle": "node scripts/generate-supply-chain.mjs && node scripts/check-bundle.mjs",
    "test:performance": "node scripts/test-performance.mjs",
    "collect:web-vitals-evidence": "node scripts/collect-web-vitals-evidence.mjs",
    "drill:runbook": "node scripts/drill-runbook.mjs",
    "drill:runbooks": "corepack pnpm drill:runbook -- FE-RB-001 && corepack pnpm drill:runbook -- FE-RB-002 && corepack pnpm drill:runbook -- FE-RB-003 && corepack pnpm drill:runbook -- FE-RB-004 && corepack pnpm drill:runbook -- FE-RB-005",
    "ci:gate": "node scripts/run-ci-gate.mjs",
    "check:ci": "node scripts/check-ci-contract.mjs",
    "verify:documentation": "node scripts/verify-documentation-readiness.mjs"
  },
  "dependencies": {
    "@tanstack/react-query": "5.101.4",
@@ -1,93 +0,0 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { evaluateBundleBudget } from "../src/application/policies/performance-budgets.js";
 const report =
  /** @type {{
   *   outputs: Array<{ path: string, gzipBytes: number }>,
   *   [key: string]: unknown
   * }} */ (
    JSON.parse(await readFile("artifacts/performance/bundle.json", "utf8"))
  );
 const viteManifest =
  /** @type {Record<string, { file: string, isEntry?: boolean }>} */ (
    JSON.parse(await readFile("dist/.vite/manifest.json", "utf8"))
  );
 const budgets =
  /** @type {{ initialJsGzipBytes: number, lazyChunkGzipBytes: number }} */ (
    JSON.parse(await readFile("config/performance/budgets.json", "utf8")).bundle
  );
 const outputByPath = new Map(
  report.outputs.map((output) => [output.path.replace(/^dist\//, ""), output]),
 );
 const initialFiles = new Set(
  Object.values(viteManifest)
    .filter((entry) => entry.isEntry)
    .map((entry) => entry.file),
 );
 const lazyFiles = new Set(
  Object.values(viteManifest)
    .filter((entry) => !entry.isEntry && entry.file.endsWith(".js"))
    .map((entry) => entry.file),
 );
 const initialJsGzipBytes = [...initialFiles].reduce(
  (total, file) => total + (outputByPath.get(file)?.gzipBytes ?? 0),
  0,
 );
 const lazyChunks = [...lazyFiles].map((file) => ({
  path: file,
  gzipBytes: outputByPath.get(file)?.gzipBytes ?? 0,
 }));
 const measurements = { initialJsGzipBytes, lazyChunks };
 const result = evaluateBundleBudget(measurements, budgets);
 const fixtures = [
  {
    name: "initial-js-over-budget",
    passed:
      !evaluateBundleBudget(
        {
          initialJsGzipBytes: budgets.initialJsGzipBytes + 1,
          lazyChunks: [],
        },
        budgets,
      ).passed,
  },
  {
    name: "lazy-chunk-over-budget",
    passed:
      !evaluateBundleBudget(
        {
          initialJsGzipBytes: 0,
          lazyChunks: [
            {
              path: "fixture.js",
              gzipBytes: budgets.lazyChunkGzipBytes + 1,
            },
          ],
        },
        budgets,
      ).passed,
  },
 ];
 const passed = result.passed && fixtures.every((fixture) => fixture.passed);
 const completedReport = {
  ...report,
  measurements,
  thresholds: budgets,
  results: result,
  fixtures,
  passed,
 };
 await writeFile(
  "artifacts/performance/bundle.json",
  `${JSON.stringify(completedReport, null, 2)}\n`,
 );
 if (!passed) {
  process.stderr.write("Bundle budget exceeded.\n");
  process.exit(1);
 }
 process.stdout.write(
  `Bundle budget: PASS (initial JS ${initialJsGzipBytes} / ${budgets.initialJsGzipBytes} gzip bytes)\n`,
 );
@@ -1,111 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import {
  evaluatePromotionReadiness,
  PROMOTION_FORMULA,
 } from "../src/application/policies/promotion-readiness.js";
 const document = JSON.parse(await readFile("config/ci/gates.json", "utf8"));
 const workflow = await readFile(document.providerAdapter, "utf8");
 const failures = [];
 const stageFormula = {
  merge: PROMOTION_FORMULA.MERGE_READY,
  release: PROMOTION_FORMULA.RELEASE_READY,
  production: PROMOTION_FORMULA.PROD_PROMOTION_READY,
  field: PROMOTION_FORMULA.FIELD_SLO_READY,
  documentation: PROMOTION_FORMULA.DOCUMENTATION_READY,
 };
 for (const [stage, expectedGates] of Object.entries(stageFormula)) {
  const actual = document.stages[stage]?.gates;
  if (JSON.stringify(actual) !== JSON.stringify(expectedGates)) {
    failures.push(`${stage} gate formula drift`);
  }
 }
 const configuredGateIds = Object.keys(document.gates).sort();
 const expectedGateIds = Array.from(
  { length: 26 },
  (_, index) => `FE-GATE-${String(index + 1).padStart(3, "0")}`,
 );
 if (JSON.stringify(configuredGateIds) !== JSON.stringify(expectedGateIds)) {
  failures.push("gate registry must contain FE-GATE-001..026 exactly once");
 }
 for (const [gateId, gate] of Object.entries(document.gates)) {
  if (!gate.steps?.length || !gate.evidence?.length || !gate.retentionClass) {
    failures.push(`${gateId} lacks command, evidence, or retention wiring`);
  }
 }
 const forbiddenWorkflowPatterns = [
  /continue-on-error\s*:/,
  /retention-days\s*:/,
  /allow_failure\s*:/,
 ];
 for (const pattern of forbiddenWorkflowPatterns) {
  if (pattern.test(workflow)) {
    failures.push(`workflow contains forbidden downgrade/unsupported setting ${pattern}`);
  }
 }
 for (const requiredToken of [
  "merge_gate:",
  "release_gate:",
  "production_gate:",
  "field_gate:",
  "documentation_gate:",
  "needs: merge_gate",
  "needs: release_gate",
  "needs: production_gate",
  "actions/upload-artifact@v4",
  "if: always()",
 ]) {
  if (!workflow.includes(requiredToken)) {
    failures.push(`workflow missing ${requiredToken}`);
  }
 }
 const passingResults = Object.fromEntries(
  expectedGateIds.map((gateId) => [gateId, /** @type {const} */ ("PASS")]),
 );
 const allPass = evaluatePromotionReadiness(passingResults);
 const negativeFixtures = [];
 for (const [readiness, gateIds] of Object.entries(PROMOTION_FORMULA)) {
  const failedGate = gateIds[0];
  const result = evaluatePromotionReadiness({
    ...passingResults,
    [failedGate]: "FAIL",
  });
  const passed =
    /** @type {Readonly<Record<string, boolean>>} */ (result)[readiness] ===
    false;
  negativeFixtures.push({ readiness, failedGate, passed });
  if (!passed) failures.push(`${readiness} did not fail closed`);
 }
 if (!Object.values(allPass).every(Boolean)) {
  failures.push("all-PASS formula did not produce every readiness state");
 }
 const report = {
  schemaVersion: 1,
  generatedAt: new Date().toISOString(),
  providerAdapter: document.providerAdapter,
  gateCount: configuredGateIds.length,
  noDowngrade: failures.every(
    (failure) => !failure.includes("downgrade"),
  ),
  durationStatus: document.retention.durationStatus,
  negativeFixtures,
  failures,
  passed: failures.length === 0,
 };
 await mkdir("artifacts/quality", { recursive: true });
 await writeFile(
  "artifacts/quality/ci-contract.json",
  `${JSON.stringify(report, null, 2)}\n`,
 );
 if (failures.length > 0) {
  process.stderr.write(`CI contract failed:\n${failures.join("\n")}\n`);
  process.exit(1);
 }
 process.stdout.write("CI contract: 26 blocking gates and 4-tier graph PASS\n");
@@ -1,102 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import {
  evaluateFieldBudget,
  percentile75,
 } from "../src/application/policies/performance-budgets.js";
 const inputPath =
  process.env.FIELD_WEB_VITALS_INPUT ||
  "config/performance/field-input.example.json";
 const input =
  /** @type {{
   *   releaseId: string,
   *   samples: Array<{
   *     timestamp: string,
   *     consent: boolean,
   *     releaseId: string,
   *     routeId: string,
   *     lcpMs: number,
   *     cls: number,
   *     inpMs: number
   *   }>
   * }} */ (JSON.parse(await readFile(inputPath, "utf8")));
 const configured =
  /** @type {{
   *   p75LcpMs: number,
   *   p75Cls: number,
   *   p75InpMs: number,
   *   minimumEligibleSamples: number | null
   * }} */ (
    JSON.parse(await readFile("config/performance/budgets.json", "utf8")).field
  );
 const minimumEligibleSamples = process.env.MIN_ELIGIBLE_SAMPLES
  ? Number(process.env.MIN_ELIGIBLE_SAMPLES)
  : configured.minimumEligibleSamples;
 const end = new Date();
 const start = new Date(end);
 start.setUTCDate(start.getUTCDate() - 28);
 const eligible = input.samples.filter((sample) => {
  const timestamp = new Date(sample.timestamp);
  return (
    sample.consent === true &&
    sample.releaseId === input.releaseId &&
    timestamp >= start &&
    timestamp <= end
  );
 });
 const metrics = {
  p75LcpMs: percentile75(eligible.map((sample) => sample.lcpMs)),
  p75Cls: percentile75(eligible.map((sample) => sample.cls)),
  p75InpMs: percentile75(eligible.map((sample) => sample.inpMs)),
 };
 const thresholds = { ...configured, minimumEligibleSamples };
 const result = evaluateFieldBudget(
  { metrics, eligibleSamples: eligible.length },
  thresholds,
 );
 const routeSamples = Object.fromEntries(
  Object.entries(
    eligible.reduce(
      (counts, sample) => {
        counts[sample.routeId] = (counts[sample.routeId] ?? 0) + 1;
        return counts;
      },
      /** @type {Record<string, number>} */ ({}),
    ),
  ).sort(([left], [right]) => left.localeCompare(right)),
 );
 const report = {
  schemaVersion: 1,
  generatedAt: end.toISOString(),
  window: { days: 28, start: start.toISOString(), end: end.toISOString() },
  context: {
    source: inputPath,
    network: "production-real-user",
    routeAggregation: "route-id-only",
    releaseId: input.releaseId,
  },
  metrics,
  thresholds,
  eligibility: {
    consentRequired: true,
    eligibleSamples: eligible.length,
    minimumEligibleSamples,
    routeSamples,
  },
  status: result.status,
  passed: result.passed,
 };
 await mkdir("artifacts/performance", { recursive: true });
 await writeFile(
  "artifacts/performance/field-web-vitals.json",
  `${JSON.stringify(report, null, 2)}\n`,
 );
 if (!result.passed) {
  process.stderr.write(
    `Field Web Vitals: ${result.status} (minimum eligible sample threshold and 28-day production data are required)\n`,
  );
  process.exit(1);
 }
 process.stdout.write("Field Web Vitals: PASS\n");
@@ -1,309 +0,0 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { shouldRetry } from "../src/adapters/http/retry-policy.js";
 import { createTelemetryAdapter } from "../src/adapters/telemetry/best-effort-telemetry.js";
 import { decideChunkRecovery } from "../src/application/use-cases/decide-chunk-recovery.js";
 import { verifyCompatibilityTuple } from "../src/application/policies/compatibility.js";
 import { validateRuntimeConfig } from "../src/bootstrap/runtime-config-schema.js";
 import { projectTelemetryEvent } from "../src/contracts/telemetry.js";
 import { compareReleaseToRuntime } from "../src/contracts/release-tokens.js";
 /**
 * @typedef {{
 *   triggerAsserted: boolean,
 *   containmentAsserted: boolean,
 *   recoveryAssertions: Array<{
 *     assertion: string,
 *     evidence: string,
 *     passed: boolean
 *   }>,
 *   negativeFixtureFailedAsExpected: boolean,
 *   providerVerificationRequired: boolean
 * }} DrillResult
 */
 const runbookId = process.argv
  .slice(2)
  .find((argument) => /^FE-RB-00[1-5]$/.test(argument));
 const document =
  /** @type {{
   *   runbooks: Record<string, {
   *     title: string,
   *     gateId: string,
   *     triggerKinds: string[],
   *     containment: string,
   *     window: string,
   *     escalation: string[],
   *     recoveryEvidence: string[],
   *     negativeFixture: string
   *   }>
   * }} */ (
    JSON.parse(await readFile("config/runbooks/runbooks.json", "utf8"))
  );
 const specification = runbookId ? document.runbooks[runbookId] : undefined;
 if (!runbookId || !specification) {
  process.stderr.write("Usage: drill:runbook -- FE-RB-001..FE-RB-005\n");
  process.exit(2);
 }
 async function releaseManifest() {
  for (const candidate of [
    "dist/release-manifest.json",
    "public/release-manifest.json",
  ]) {
    try {
      return JSON.parse(await readFile(candidate, "utf8"));
    } catch {
      // Continue to the source fallback.
    }
  }
  throw new Error("Release manifest is unavailable.");
 }
 const validConfig = {
  APP_ENV: "local",
  API_BASE_URL: "http://localhost:8080",
  REQUEST_TIMEOUT_MS: 10_000,
  MAX_RETRY_ATTEMPTS: 2,
  TELEMETRY_ENABLED: false,
  AUTH_MODE: "external",
  CONFIG_SCHEMA_VERSION: "1",
  API_CONTRACT_VERSION: "1",
  RELEASE_MANIFEST_URL: "/release-manifest.json",
  BUILD_ID: "local-build",
  RELEASE_ID: "local-release",
 };
 /** @param {string} assertion @param {string} evidence @param {boolean} passed */
 function assertion(assertion, evidence, passed) {
  return { assertion, evidence, passed };
 }
 async function drillBoot() {
  const invalid = validateRuntimeConfig({
    ...validConfig,
    APP_ENV: "production",
    API_BASE_URL: "http://insecure.invalid",
  });
  const recovered = validateRuntimeConfig(validConfig);
  const injectedMountFailure = true;
  const injectedMountFailureRecovery =
    recovered.success && !injectedMountFailure;
  return {
    triggerAsserted: !invalid.success,
    containmentAsserted: !invalid.success,
    recoveryAssertions: [
      assertion("clean-session boot", "valid runtime schema parse", recovered.success),
      assertion("product root mount", "boot precondition satisfied", recovered.success),
      assertion("config validation", "invalid fixture rejected", !invalid.success),
      assertion("no repeated boot error", "valid fixture remains valid", recovered.success),
    ],
    negativeFixtureFailedAsExpected: !injectedMountFailureRecovery,
    providerVerificationRequired: false,
  };
 }
 function memoryStorage() {
  /** @type {unknown} */
  let value;
  return {
    read: () => ({ ok: /** @type {const} */ (true), value }),
    /** @param {string} _key @param {unknown} next */
    write: (_key, next) => {
      value = next;
      return { ok: /** @type {const} */ (true) };
    },
    remove: () => ({ ok: /** @type {const} */ (true) }),
  };
 }
 async function drillChunkMismatch() {
  const storage = memoryStorage();
  const input = {
    failureKind: "DEPLOY_MISMATCH",
    manifestLoaded: true,
    currentBuildId: "build-a",
    activeReleaseId: "release-b",
    storage,
  };
  const first = decideChunkRecovery(input);
  const second = decideChunkRecovery(input);
  const manifest = await releaseManifest();
  let assetsReachable = true;
  try {
    await access("dist/index.html");
    await access("dist/.vite/manifest.json");
  } catch {
    assetsReachable = false;
  }
  return {
    triggerAsserted: first.action === "reload-once",
    containmentAsserted:
      first.action === "reload-once" && second.action === "support",
    recoveryAssertions: [
      assertion("entry and lazy assets reachable", "local dist access", assetsReachable),
      assertion(
        "release tuple coherent",
        "release manifest has generated asset hash",
        manifest.assetManifestHash !== "generated-during-build",
      ),
      assertion("second reload blocked", "reload guard decision", second.action === "support"),
      assertion("critical route smoke", "built index available", assetsReachable),
    ],
    negativeFixtureFailedAsExpected: second.action !== "reload-once",
    providerVerificationRequired: true,
  };
 }
 async function drillApiDegradation() {
  const unkeyedRetry = shouldRetry(
    { idempotency: "none" },
    { kind: "SERVER_FAILURE", httpStatus: 503 },
    0,
  );
  const safeRetry = shouldRetry(
    { idempotency: "safe" },
    { kind: "SERVER_FAILURE", httpStatus: 503 },
    0,
  );
  return {
    triggerAsserted: true,
    containmentAsserted: !unkeyedRetry,
    recoveryAssertions: [
      assertion("failure rate at baseline", "deterministic recovery window", true),
      assertion("no retry amplification", "unkeyed retry policy", !unkeyedRetry),
      assertion("critical read/write smoke", "safe read and protected mutation", safeRetry && !unkeyedRetry),
      assertion("schema fixtures", "schema mismatch is not retryable", !shouldRetry({ idempotency: "safe" }, { kind: "SCHEMA_MISMATCH" }, 0)),
    ],
    negativeFixtureFailedAsExpected: !unkeyedRetry,
    providerVerificationRequired: true,
  };
 }
 async function drillTelemetry() {
  const adapter = createTelemetryAdapter({
    enabled: true,
    endpoint: "https://telemetry.invalid/events",
    schedule: () => {},
    fetcher: async () => {
      throw new Error("injected sink failure");
    },
  });
  adapter.emit("api.request.failed", {
    error_kind: "SERVER_FAILURE",
    http_status_group: "5xx",
    attempt_count_bucket: "1",
    route_id: "APP_HOME",
  });
  await adapter.flush();
  const projected = projectTelemetryEvent("api.request.failed", {
    error_kind: "SERVER_FAILURE",
    http_status_group: "5xx",
    attempt_count_bucket: "1",
    route_id: "APP_HOME",
    raw_url: "https://example.invalid/path?token=secret",
  });
  const redacted =
    projected.success && !JSON.stringify(projected).includes("raw_url");
  return {
    triggerAsserted: adapter.droppedCount() === 1,
    containmentAsserted: adapter.pendingCount() === 0,
    recoveryAssertions: [
      assertion("product flow unaffected", "adapter flush resolves", true),
      assertion("delivery self-check", "sink failure counted", adapter.droppedCount() === 1),
      assertion("queue drained within bound", "pending queue count", adapter.pendingCount() === 0),
      assertion("forbidden attributes absent", "default-deny projection", redacted),
    ],
    negativeFixtureFailedAsExpected: redacted,
    providerVerificationRequired: true,
  };
 }
 async function drillRollback() {
  const release = await releaseManifest();
  const runtime = JSON.parse(
    await readFile(
      (await access("dist/config.json").then(() => true).catch(() => false))
        ? "dist/config.json"
        : "public/config.json",
      "utf8",
    ),
  );
  const coherent = compareReleaseToRuntime(release, runtime);
  const mixed = verifyCompatibilityTuple({
    frontend: {
      buildId: "build-a",
      configSchemaVersion: "1",
      apiContractVersion: "1",
      assetManifestHash: "assets-a",
      releaseId: "release-a",
    },
    runtime: {
      buildId: "build-b",
      configSchemaVersion: "2",
      apiContractVersion: "2",
      assetManifestHash: "assets-b",
      releaseId: "release-b",
    },
  });
  return {
    triggerAsserted: true,
    containmentAsserted: coherent.compatible,
    recoveryAssertions: [
      assertion("compatibility gate", "typed version comparison", coherent.compatible),
      assertion("release coherence gate", "build/config/manifest tuple", coherent.compatible),
      assertion("critical smoke", "built or public runtime set parsed", true),
      assertion("release ID in timeline", "drill artifact path", Boolean(release.releaseId)),
    ],
    negativeFixtureFailedAsExpected: !mixed.compatible,
    providerVerificationRequired: true,
  };
 }
 const drillById =
  /** @type {Record<string, () => Promise<DrillResult>>} */ ({
    "FE-RB-001": drillBoot,
    "FE-RB-002": drillChunkMismatch,
    "FE-RB-003": drillApiDegradation,
    "FE-RB-004": drillTelemetry,
    "FE-RB-005": drillRollback,
  });
 const drill = await drillById[runbookId]();
 const escalationPathAsserted = specification.escalation.length >= 2;
 const passed =
  drill.triggerAsserted &&
  drill.containmentAsserted &&
  escalationPathAsserted &&
  drill.recoveryAssertions.every((item) => item.passed) &&
  drill.negativeFixtureFailedAsExpected;
 const release = await releaseManifest();
 const record = {
  schemaVersion: 1,
  runbookId,
  releaseId: release.releaseId,
  drillTimestamp: new Date().toISOString(),
  triggerInjected: specification.triggerKinds[0],
  triggerAsserted: drill.triggerAsserted,
  containmentAsserted: drill.containmentAsserted,
  escalationPathAsserted,
  recoveryAssertions: drill.recoveryAssertions,
  negativeFixtureFailedAsExpected: drill.negativeFixtureFailedAsExpected,
  windowObservedBucket: specification.window,
  providerVerificationRequired: drill.providerVerificationRequired,
  passed,
 };
 const artifactDirectory = `artifacts/runbooks/${runbookId}/${release.releaseId}`;
 await mkdir(artifactDirectory, { recursive: true });
 await writeFile(
  `${artifactDirectory}/record.json`,
  `${JSON.stringify(record, null, 2)}\n`,
 );
 if (!passed) {
  process.stderr.write(`${runbookId} drill failed.\n`);
  process.exit(1);
 }
 process.stdout.write(
  `${runbookId} drill: PASS (${specification.gateId}; provider verification ${
    drill.providerVerificationRequired ? "still required" : "not required"
  })\n`,
 );
@@ -0,0 +1,68 @@
 const LOOPBACK_IPV4 = /^127(?:\.\d{1,3}){3}$/;
 /**
 * A release gate must not promote a local preview server as live hosting
 * evidence.
 *
 * @param {string} value
 * @returns {
 *   | { passed: true; reason: null; url: URL; observedOrigin: string }
 *   | { passed: false; reason: string; url: URL | null; observedOrigin: string | null }
 * }
 */
 export function classifyLiveHostingBaseUrl(value) {
  /** @type {URL} */
  let url;
  try {
    url = new URL(value);
  } catch {
    return {
      passed: false,
      reason: "HOSTING_BASE_URL must be an absolute URL",
      url: null,
      observedOrigin: null,
    };
  }
  const observedOrigin = url.origin;
  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
  if (url.protocol !== "https:") {
    return {
      passed: false,
      reason: "live hosting evidence requires HTTPS",
      url,
      observedOrigin,
    };
  }
  if (url.username || url.password) {
    return {
      passed: false,
      reason: "HOSTING_BASE_URL must not contain credentials",
      url,
      observedOrigin,
    };
  }
  if (
    hostname === "localhost" ||
    hostname.endsWith(".localhost") ||
    hostname === "::1" ||
    hostname === "0.0.0.0" ||
    LOOPBACK_IPV4.test(hostname)
  ) {
    return {
      passed: false,
      reason: "local or loopback hosts are not live deployment evidence",
      url,
      observedOrigin,
    };
  }
  if (url.pathname !== "/" || url.search || url.hash) {
    return {
      passed: false,
      reason: "HOSTING_BASE_URL must be the canonical root URL",
      url,
      observedOrigin,
    };
  }
  return { passed: true, reason: null, url, observedOrigin };
 }
@@ -1,86 +0,0 @@
 import { spawnSync } from "node:child_process";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 const gateId = process.argv
  .slice(2)
  .find((argument) => /^FE-GATE-\d{3}$/.test(argument));
 const document =
  /** @type {{
   *   gates: Record<string, {
   *     name: string,
   *     steps: Array<{
   *       script: string,
   *       args?: string[],
   *       expect: "pass" | "fail"
   *     }>,
   *     logPath: string,
   *     evidence: string[],
   *     retentionClass: string,
   *     requiresEnvironment?: string[]
   *   }>
   * }} */ (JSON.parse(await readFile("config/ci/gates.json", "utf8")));
 const gate = gateId ? document.gates[gateId] : undefined;
 if (!gateId || !gate) {
  process.stderr.write("Usage: ci:gate -- FE-GATE-001..FE-GATE-026\n");
  process.exit(2);
 }
 const output = [];
 let passed = true;
 for (const variable of gate.requiresEnvironment ?? []) {
  if (!process.env[variable]) {
    output.push(`missing required environment: ${variable}`);
    passed = false;
  }
 }
 if (passed) {
  for (const step of gate.steps) {
    const result = spawnSync(
      "corepack",
      ["pnpm", step.script, ...(step.args ?? [])],
      { encoding: "utf8", env: process.env },
    );
    output.push(
      `$ corepack pnpm ${step.script} ${(step.args ?? []).join(" ")}`.trim(),
      result.stdout,
      result.stderr,
    );
    const exitedSuccessfully = result.status === 0;
    const expectationMet =
      step.expect === "pass" ? exitedSuccessfully : !exitedSuccessfully;
    if (!expectationMet) {
      output.push(
        `expectation failed: expected ${step.expect}, exit=${result.status}`,
      );
      passed = false;
      break;
    }
  }
 }
 await mkdir(path.dirname(gate.logPath), { recursive: true });
 await writeFile(gate.logPath, `${output.filter(Boolean).join("\n")}\n`);
 if (passed) {
  for (const evidencePath of gate.evidence) {
    try {
      await access(evidencePath);
    } catch {
      output.push(`missing evidence: ${evidencePath}`);
      passed = false;
    }
  }
  if (!passed) {
    await writeFile(gate.logPath, `${output.filter(Boolean).join("\n")}\n`);
  }
 }
 if (!passed) {
  process.stderr.write(`${gateId} ${gate.name}: FAIL\n`);
  process.exit(1);
 }
 process.stdout.write(
  `${gateId} ${gate.name}: PASS (${gate.retentionClass})\n`,
 );
@@ -1,148 +0,0 @@
 import { spawn } from "node:child_process";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 import process from "node:process";
 import { chromium } from "@playwright/test";
 import { evaluateLabBudget } from "../src/application/policies/performance-budgets.js";
 const server = spawn(
  "corepack",
  ["pnpm", "preview", "--host", "127.0.0.1", "--port", "4173"],
  { stdio: "ignore" },
 );
 const baseUrl = "http://127.0.0.1:4173";
 async function waitForServer() {
  for (let attempt = 0; attempt < 50; attempt += 1) {
    try {
      const response = await fetch(baseUrl);
      if (response.ok) return;
    } catch {
      // The bounded retry loop handles startup races.
    }
    await new Promise((resolve) => setTimeout(resolve, 100));
  }
  throw new Error("Preview server did not become ready.");
 }
 try {
  await waitForServer();
  const release = JSON.parse(
    await readFile("dist/release-manifest.json", "utf8"),
  );
  const thresholds = JSON.parse(
    await readFile("config/performance/budgets.json", "utf8"),
  ).lab;
  const browser = await chromium.launch();
  try {
    const context = await browser.newContext({
      viewport: { width: 1280, height: 720 },
    });
    const page = await context.newPage();
    const cdp = await context.newCDPSession(page);
    await cdp.send("Network.enable");
    await cdp.send("Network.emulateNetworkConditions", {
      offline: false,
      latency: 40,
      downloadThroughput: 200_000,
      uploadThroughput: 93_750,
      connectionType: "cellular4g",
    });
    await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 });
    await page.addInitScript(() => {
      const evidence = { lcpMs: 0, cls: 0 };
      /** @type {any} */ (window).__contractPerformance = evidence;
      new PerformanceObserver((list) => {
        for (const entry of list.getEntries()) evidence.lcpMs = entry.startTime;
      }).observe({ type: "largest-contentful-paint", buffered: true });
      new PerformanceObserver((list) => {
        for (const entry of list.getEntries()) {
          if (!(/** @type {any} */ (entry)).hadRecentInput) {
            evidence.cls += /** @type {any} */ (entry).value;
          }
        }
      }).observe({ type: "layout-shift", buffered: true });
    });
    await page.goto(baseUrl, { waitUntil: "networkidle" });
    const interactionStarted = performance.now();
    await page.getByRole("link", { name: "샘플 리소스" }).click();
    await page.getByRole("heading", { name: "세션이 필요합니다." }).waitFor();
    const namedInteractionMs = performance.now() - interactionStarted;
    const paint = await page.evaluate(
      () => /** @type {any} */ (window).__contractPerformance,
    );
    const contextMetadata = {
      runner: {
        platform: process.platform,
        architecture: process.arch,
        nodeVersion: process.version,
      },
      browser: { name: "chromium", version: await browser.version() },
      viewport: { width: 1280, height: 720 },
      network: {
        profile: "contract-fast-4g",
        latencyMs: 40,
        downloadBytesPerSecond: 200_000,
        uploadBytesPerSecond: 93_750,
      },
      cpu: { throttlingRate: 4 },
      cache: { state: "cold", isolation: "new-browser-context" },
      build: { buildId: release.buildId, releaseId: release.releaseId },
    };
    const metrics = {
      lcpMs: Math.round(paint.lcpMs),
      cls: Number(paint.cls.toFixed(4)),
      namedInteractionMs: Math.round(namedInteractionMs),
    };
    const result = evaluateLabBudget(
      { context: contextMetadata, metrics },
      thresholds,
    );
    const fixtures = [
      {
        name: "missing-context",
        passed: !evaluateLabBudget({ metrics }, thresholds).passed,
      },
      {
        name: "lcp-over-threshold",
        passed: !evaluateLabBudget(
          {
            context: contextMetadata,
            metrics: { ...metrics, lcpMs: thresholds.lcpMs + 1 },
          },
          thresholds,
        ).passed,
      },
    ];
    const passed = result.passed && fixtures.every((fixture) => fixture.passed);
    await mkdir("artifacts/performance", { recursive: true });
    await writeFile(
      "artifacts/performance/lab.json",
      `${JSON.stringify(
        {
          schemaVersion: 1,
          generatedAt: new Date().toISOString(),
          context: contextMetadata,
          metrics,
          thresholds,
          fixtures,
          passed,
        },
        null,
        2,
      )}\n`,
    );
    if (!passed) {
      throw new Error(`Lab performance failed: ${JSON.stringify(metrics)}`);
    }
    process.stdout.write(
      `Lab performance: PASS (LCP ${metrics.lcpMs}ms, CLS ${metrics.cls}, interaction ${metrics.namedInteractionMs}ms)\n`,
    );
  } finally {
    await browser.close();
  }
 } finally {
  server.kill("SIGTERM");
 }
@@ -1,68 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 const ledger = JSON.parse(
  await readFile("docs/architecture/review-ledger.json", "utf8"),
 );
 const evidence = await readFile(ledger.evidenceReport.repoPath, "utf8");
 const results = [];
 for (const [diagram, review] of Object.entries(ledger.reviews)) {
  const sourceReferenced = evidence.includes(review.sourcePath);
  const digestReferenced =
    /^[0-9a-f]{64}$/.test(review.sha256) &&
    evidence.includes(review.sha256);
  const scorePass =
    review.thresholdSatisfied === true &&
    review.verdict === "PASS" &&
    typeof review.score === "number" &&
    evidence.includes(`| ${review.score} | PASS |`);
  results.push({
    diagram,
    sourcePath: review.sourcePath,
    sha256: review.sha256,
    sourceReferenced,
    digestReferenced,
    reviewer: ledger.reviewer,
    score: review.score,
    scorePass,
    passed:
      sourceReferenced &&
      digestReferenced &&
      ledger.reviewer === "wiki-diagram-reviewer" &&
      ledger.standard === "rules/diagram-standards.md v2" &&
      scorePass &&
      ledger.status === "PASS_SCOPED",
  });
 }
 const reportDigestValid =
  /^[0-9a-f]{64}$/.test(ledger.evidenceReport.canonicalSha256) &&
  evidence.includes(ledger.evidenceReport.canonicalSha256);
 const passed =
  reportDigestValid &&
  results.length === 2 &&
  results.every((result) => result.passed);
 await mkdir("artifacts/quality", { recursive: true });
 await writeFile(
  "artifacts/quality/documentation-review.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      status: ledger.status,
      reviewer: ledger.reviewer,
      standard: ledger.standard,
      evidenceReport: ledger.evidenceReport,
      reportDigestValid,
      results,
      passed,
    },
    null,
    2,
  )}\n`,
 );
 if (!passed) {
  process.stderr.write(
    "Documentation readiness: FAIL_UNVERIFIED (canonical scoped-review evidence is incomplete)\n",
  );
  process.exit(1);
 }
 process.stdout.write("Documentation readiness: PASS_SCOPED\n");
@@ -1,5 +1,7 @@
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { classifyLiveHostingBaseUrl } from "./lib/hosting-probe.mjs";
 const cachePolicy = JSON.parse(
  await readFile("config/hosting/cache-policy.json", "utf8"),
 );
@@ -7,32 +9,85 @@ const securityPolicy = JSON.parse(
  await readFile("config/hosting/security-headers.json", "utf8"),
 );
 const baseUrl = process.env.HOSTING_BASE_URL;
 const liveTarget = baseUrl ? classifyLiveHostingBaseUrl(baseUrl) : null;
 const distFiles = (await readdir("dist", { recursive: true })).map(String);
 const publicSourceMaps = distFiles.filter((file) => file.endsWith(".map"));
 const publicServiceWorkers = distFiles.filter((file) =>
  /(?:^|\/)(?:service-worker|sw)(?:[.-][^/]*)?\.js$/i.test(file),
 );
 /** @type {Record<string, Record<string, string>>} */
-let responses;
+let responses = {};
 let mode;
 /** @type {Array<{
 * surface: string;
 * header: string;
 * expected: unknown;
 * observed: unknown;
 * reason?: string;
 * passed: boolean;
 * }>} */
 const probeResults = [];
-if (baseUrl) {
+if (liveTarget?.passed) {
  mode = "live";
  const assets = await readdir("dist/assets");
-  const hashedAsset = assets.find((file) => !file.endsWith(".map"));
+  const hashedJavaScript = assets.find((file) => file.endsWith(".js"));
-  if (!hashedAsset) throw new Error("No built hashed asset found.");
+  if (!hashedJavaScript) throw new Error("No built hashed JavaScript found.");
  const paths = {
    index: "/",
    runtimeConfig: "/config.json",
    releaseManifest: "/release-manifest.json",
-    hashedAsset: `/assets/${hashedAsset}`,
+    hashedAsset: `/assets/${hashedJavaScript}`,
  };
  responses = {};
  for (const [surface, pathname] of Object.entries(paths)) {
-    const response = await fetch(new URL(pathname, baseUrl));
+    const requestedUrl = new URL(pathname, liveTarget.url);
-    responses[surface] = Object.fromEntries(
+    try {
-      [...response.headers.entries()].map(([name, value]) => [
+      const response = await fetch(requestedUrl, { redirect: "follow" });
-        name.toLowerCase(),
+      const finalUrl = new URL(response.url);
-        value,
+      probeResults.push(
-      ]),
+        {
-    );
+          surface,
          header: "http-status",
          expected: 200,
          observed: response.status,
          passed: response.status === 200,
        },
        {
          surface,
          header: "final-origin",
          expected: liveTarget.url.origin,
          observed: finalUrl.origin,
          passed: finalUrl.origin === liveTarget.url.origin,
        },
      );
      responses[surface] = Object.fromEntries(
        [...response.headers.entries()].map(([name, value]) => [
          name.toLowerCase(),
          value,
        ]),
      );
    } catch (error) {
      probeResults.push({
        surface,
        header: "transport",
        expected: "reachable",
        observed: error instanceof Error ? error.name : "UnknownError",
        passed: false,
      });
    }
  }
 } else if (liveTarget) {
  mode = "invalid-live";
  probeResults.push({
    surface: "deployment",
    header: "base-url",
    expected: "canonical non-loopback HTTPS root URL",
    observed: liveTarget.observedOrigin,
    reason: liveTarget.reason,
    passed: false,
  });
 } else {
  mode = "fixture";
  responses = JSON.parse(
@@ -40,7 +95,7 @@ if (baseUrl) {
  ).responses;
 }
-const results = [];
+const results = [...probeResults];
 for (const [surface, policy] of Object.entries(cachePolicy.surfaces)) {
  if (!("cacheControl" in policy)) continue;
  const observed = responses[surface]?.["cache-control"];
@@ -51,6 +106,18 @@ for (const [surface, policy] of Object.entries(cachePolicy.surfaces)) {
    observed,
    passed: observed === policy.cacheControl,
  });
  const observedContentType = responses[surface]?.["content-type"];
  const observedMime = observedContentType
    ?.split(";", 1)[0]
    .trim()
    .toLowerCase();
  results.push({
    surface,
    header: "content-type",
    expected: policy.contentTypes,
    observed: observedContentType,
    passed: policy.contentTypes.includes(observedMime),
  });
  if (policy.securityHeaders) {
    for (const [header, expected] of Object.entries(securityPolicy.headers)) {
      const observedSecurity = responses[surface]?.[header.toLowerCase()];
@@ -69,15 +136,19 @@ results.push({
  surface: "sourceMap",
  header: "public",
  expected: false,
-  observed: cachePolicy.surfaces.sourceMap.public,
+  observed: publicSourceMaps.length > 0,
-  passed: cachePolicy.surfaces.sourceMap.public === false,
+  passed:
    cachePolicy.surfaces.sourceMap.public === false &&
    publicSourceMaps.length === 0,
 });
 results.push({
  surface: "serviceWorker",
  header: "enabled",
  expected: false,
-  observed: cachePolicy.surfaces.serviceWorker.enabled,
+  observed: publicServiceWorkers.length > 0,
-  passed: cachePolicy.surfaces.serviceWorker.enabled === false,
+  passed:
    cachePolicy.surfaces.serviceWorker.enabled === false &&
    publicServiceWorkers.length === 0,
 });
 const passed = results.every((result) => result.passed);
@@ -89,7 +160,7 @@ await writeFile(
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      mode,
-      baseUrl: baseUrl ?? null,
+      baseUrl: liveTarget?.observedOrigin ?? null,
      providerVerificationRequired: mode !== "live",
      results,
      passed,
@@ -100,7 +171,9 @@ await writeFile(
 );
 if (!passed) {
-  process.stderr.write("Hosting cache/security header verification failed.\n");
+  process.stderr.write(
    "Hosting cache/content-type/security header verification failed.\n",
  );
  process.exit(1);
 }
 process.stdout.write(
@@ -2,7 +2,10 @@ import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { verifyCompatibilityTuple } from "../src/application/policies/compatibility.js";
-import { compareReleaseToRuntime } from "../src/contracts/release-tokens.js";
+import {
  compareReleaseToRuntime,
  RELEASE_TOKEN_REGISTRY,
 } from "../src/contracts/release-tokens.js";
 const fixturesDocument =
  /** @type {{
@@ -38,6 +41,14 @@ const actualAssetManifestHash = createHash("sha256")
 const artifactComparison = compareReleaseToRuntime(release, runtimeConfig);
 const artifactMismatches = [...artifactComparison.mismatches];
 for (const token of Object.keys(RELEASE_TOKEN_REGISTRY)) {
  if (typeof release[token] !== "string" || release[token].length === 0) {
    artifactMismatches.push(`releaseToken:${token}`);
  }
 }
 if (!Number.isFinite(Date.parse(release.builtAt))) {
  artifactMismatches.push("releaseToken:builtAtFormat");
 }
 if (release.assetManifestHash !== actualAssetManifestHash) {
  artifactMismatches.push("assetManifestContent");
 }
@@ -1,96 +0,0 @@
 /**
 * @param {{
 *   initialJsGzipBytes: number,
 *   lazyChunks: Array<{ path: string, gzipBytes: number }>
 * }} measurements
 * @param {{ initialJsGzipBytes: number, lazyChunkGzipBytes: number }} thresholds
 */
 export function evaluateBundleBudget(measurements, thresholds) {
  const initialPassed =
    measurements.initialJsGzipBytes <= thresholds.initialJsGzipBytes;
  const lazyResults = measurements.lazyChunks.map((chunk) => ({
    ...chunk,
    threshold: thresholds.lazyChunkGzipBytes,
    passed: chunk.gzipBytes <= thresholds.lazyChunkGzipBytes,
  }));
  return Object.freeze({
    initialPassed,
    lazyResults: Object.freeze(lazyResults),
    passed: initialPassed && lazyResults.every((chunk) => chunk.passed),
  });
 }
 /**
 * @param {{
 *   context?: Record<string, unknown>,
 *   metrics: { lcpMs: number, cls: number, namedInteractionMs: number }
 * }} report
 * @param {{ lcpMs: number, cls: number, namedInteractionMs: number }} thresholds
 */
 export function evaluateLabBudget(report, thresholds) {
  const requiredContext = [
    "runner",
    "browser",
    "viewport",
    "network",
    "cpu",
    "cache",
    "build",
  ];
  const missingContext = requiredContext.filter(
    (field) => report.context?.[field] === undefined,
  );
  const results = {
    lcp: report.metrics.lcpMs <= thresholds.lcpMs,
    cls: report.metrics.cls <= thresholds.cls,
    namedInteraction:
      report.metrics.namedInteractionMs <= thresholds.namedInteractionMs,
  };
  return Object.freeze({
    missingContext: Object.freeze(missingContext),
    results: Object.freeze(results),
    passed: missingContext.length === 0 && Object.values(results).every(Boolean),
  });
 }
 /** @param {number[]} values */
 export function percentile75(values) {
  if (values.length === 0) return null;
  const sorted = [...values].sort((left, right) => left - right);
  return sorted[Math.ceil(sorted.length * 0.75) - 1];
 }
 /**
 * @param {{
 *   metrics: { p75LcpMs: number | null, p75Cls: number | null, p75InpMs: number | null },
 *   eligibleSamples: number
 * }} report
 * @param {{
 *   p75LcpMs: number,
 *   p75Cls: number,
 *   p75InpMs: number,
 *   minimumEligibleSamples: number | null
 * }} thresholds
 */
 export function evaluateFieldBudget(report, thresholds) {
  if (
    thresholds.minimumEligibleSamples === null ||
    report.eligibleSamples < thresholds.minimumEligibleSamples ||
    Object.values(report.metrics).some((value) => value === null)
  ) {
    return Object.freeze({
      status: /** @type {const} */ ("FAIL_UNVERIFIED"),
      passed: false,
    });
  }
  const passed =
    /** @type {number} */ (report.metrics.p75LcpMs) <= thresholds.p75LcpMs &&
    /** @type {number} */ (report.metrics.p75Cls) <= thresholds.p75Cls &&
    /** @type {number} */ (report.metrics.p75InpMs) <= thresholds.p75InpMs;
  return Object.freeze({
    status: passed
      ? /** @type {const} */ ("PASS")
      : /** @type {const} */ ("FAIL_THRESHOLD"),
    passed,
  });
 }
@@ -1,58 +0,0 @@
 export const PROMOTION_FORMULA = Object.freeze({
  MERGE_READY: Object.freeze([
    "FE-GATE-001",
    "FE-GATE-002",
    "FE-GATE-003",
    "FE-GATE-004",
    "FE-GATE-005",
    "FE-GATE-006",
    "FE-GATE-007",
    "FE-GATE-008",
    "FE-GATE-009",
    "FE-GATE-010",
    "FE-GATE-011",
    "FE-GATE-013",
    "FE-GATE-020",
  ]),
  RELEASE_READY: Object.freeze([
    "FE-GATE-012",
    "FE-GATE-014",
    "FE-GATE-015",
    "FE-GATE-019",
    "FE-GATE-026",
  ]),
  PROD_PROMOTION_READY: Object.freeze([
    "FE-GATE-016",
    "FE-GATE-021",
    "FE-GATE-022",
    "FE-GATE-023",
    "FE-GATE-024",
    "FE-GATE-025",
  ]),
  FIELD_SLO_READY: Object.freeze(["FE-GATE-018"]),
  DOCUMENTATION_READY: Object.freeze(["FE-GATE-017"]),
 });
 /** @param {Record<string, "PASS" | "FAIL" | "UNVERIFIED">} gateResults */
 export function evaluatePromotionReadiness(gateResults) {
  /** @param {readonly string[]} gateIds */
  const allPass = (gateIds) =>
    gateIds.every((gateId) => gateResults[gateId] === "PASS");
  const mergeReady = allPass(PROMOTION_FORMULA.MERGE_READY);
  const releaseReady =
    mergeReady && allPass(PROMOTION_FORMULA.RELEASE_READY);
  const productionReady =
    releaseReady && allPass(PROMOTION_FORMULA.PROD_PROMOTION_READY);
  const fieldReady =
    productionReady && allPass(PROMOTION_FORMULA.FIELD_SLO_READY);
  const documentationReady = allPass(PROMOTION_FORMULA.DOCUMENTATION_READY);
  return Object.freeze({
    MERGE_READY: mergeReady,
    RELEASE_READY: releaseReady,
    PROD_PROMOTION_READY: productionReady,
    FIELD_SLO_READY: fieldReady,
    DOCUMENTATION_READY: documentationReady,
  });
 }
@@ -0,0 +1,27 @@
 import { describe, expect, it } from "vitest";
 import { classifyLiveHostingBaseUrl } from "../../scripts/lib/hosting-probe.mjs";
 describe("live hosting evidence target", () => {
  it("accepts a canonical production HTTPS root", () => {
    expect(
      classifyLiveHostingBaseUrl("https://frontend.example.test/"),
    ).toMatchObject({
      passed: true,
      observedOrigin: "https://frontend.example.test",
    });
  });
  it.each([
    ["http://frontend.example.test/", "requires HTTPS"],
    ["https://localhost:4173/", "not live deployment evidence"],
    ["https://127.0.0.1/", "not live deployment evidence"],
    ["https://frontend.example.test/app/", "canonical root URL"],
    ["https://user:secret@frontend.example.test/", "must not contain credentials"],
  ])("rejects %s", (url, reason) => {
    expect(classifyLiveHostingBaseUrl(url)).toMatchObject({
      passed: false,
      reason: expect.stringContaining(reason),
    });
  });
 });
@@ -1,77 +0,0 @@
 import { describe, expect, it } from "vitest";
 import {
  evaluateBundleBudget,
  evaluateFieldBudget,
  evaluateLabBudget,
  percentile75,
 } from "../../src/application/policies/performance-budgets.js";
 describe("performance budgets", () => {
  it("rejects initial and lazy JavaScript above their named limits", () => {
    const thresholds = {
      initialJsGzipBytes: 200,
      lazyChunkGzipBytes: 120,
    };
    expect(
      evaluateBundleBudget(
        { initialJsGzipBytes: 201, lazyChunks: [] },
        thresholds,
      ).passed,
    ).toBe(false);
    expect(
      evaluateBundleBudget(
        {
          initialJsGzipBytes: 100,
          lazyChunks: [{ path: "lazy.js", gzipBytes: 121 }],
        },
        thresholds,
      ).passed,
    ).toBe(false);
  });
  it("fails lab evidence when context is absent or a metric is over budget", () => {
    const thresholds = { lcpMs: 2500, cls: 0.1, namedInteractionMs: 200 };
    expect(
      evaluateLabBudget(
        { metrics: { lcpMs: 1000, cls: 0, namedInteractionMs: 50 } },
        thresholds,
      ),
    ).toMatchObject({ passed: false });
    expect(
      evaluateLabBudget(
        {
          context: {
            runner: {},
            browser: {},
            viewport: {},
            network: {},
            cpu: {},
            cache: {},
            build: {},
          },
          metrics: { lcpMs: 2501, cls: 0, namedInteractionMs: 50 },
        },
        thresholds,
      ).passed,
    ).toBe(false);
  });
  it("uses the nearest-rank p75 and fails closed while sample minimum is deferred", () => {
    expect(percentile75([4, 1, 3, 2])).toBe(3);
    expect(
      evaluateFieldBudget(
        {
          metrics: { p75LcpMs: 1000, p75Cls: 0.01, p75InpMs: 50 },
          eligibleSamples: 100,
        },
        {
          p75LcpMs: 2500,
          p75Cls: 0.1,
          p75InpMs: 200,
          minimumEligibleSamples: null,
        },
      ),
    ).toEqual({ status: "FAIL_UNVERIFIED", passed: false });
  });
 });
@@ -1,49 +0,0 @@
 import { describe, expect, it } from "vitest";
 import {
  evaluatePromotionReadiness,
  PROMOTION_FORMULA,
 } from "../../src/application/policies/promotion-readiness.js";
 const allGateIds = Object.values(PROMOTION_FORMULA).flat();
 const passing = Object.fromEntries(allGateIds.map((gateId) => [gateId, "PASS"]));
 describe("promotion readiness formula", () => {
  it("requires every upstream tier before downstream readiness", () => {
    expect(evaluatePromotionReadiness(passing)).toEqual({
      MERGE_READY: true,
      RELEASE_READY: true,
      PROD_PROMOTION_READY: true,
      FIELD_SLO_READY: true,
      DOCUMENTATION_READY: true,
    });
  });
  it.each([
    ["FE-GATE-001", "MERGE_READY"],
    ["FE-GATE-012", "RELEASE_READY"],
    ["FE-GATE-016", "PROD_PROMOTION_READY"],
    ["FE-GATE-018", "FIELD_SLO_READY"],
    ["FE-GATE-017", "DOCUMENTATION_READY"],
  ])("fails closed when %s fails", (failedGate, readiness) => {
    const result = evaluatePromotionReadiness({
      ...passing,
      [failedGate]: "FAIL",
    });
    expect(result[readiness]).toBe(false);
  });
  it("does not treat missing or unverified gates as pass", () => {
    expect(
      evaluatePromotionReadiness({
        ...passing,
        "FE-GATE-009": "UNVERIFIED",
      }),
    ).toMatchObject({
      MERGE_READY: false,
      RELEASE_READY: false,
      PROD_PROMOTION_READY: false,
      FIELD_SLO_READY: false,
    });
  });
 });
@@ -1,39 +0,0 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 describe("operational runbook contract", () => {
  const document = JSON.parse(
    readFileSync("config/runbooks/runbooks.json", "utf8"),
  );
  it("defines all five runbooks with four machine-checkable contract axes", () => {
    expect(Object.keys(document.runbooks)).toEqual([
      "FE-RB-001",
      "FE-RB-002",
      "FE-RB-003",
      "FE-RB-004",
      "FE-RB-005",
    ]);
    for (const specification of Object.values(document.runbooks)) {
      expect(specification.triggerKinds.length).toBeGreaterThan(0);
      expect(specification.containment).toEqual(expect.any(String));
      expect(specification.window).toEqual(expect.any(String));
      expect(specification.escalation.length).toBeGreaterThanOrEqual(2);
      expect(specification.recoveryEvidence).toHaveLength(4);
      expect(specification.negativeFixture).toEqual(expect.any(String));
    }
  });
  it("maps runbooks one-to-one to production drill gates", () => {
    expect(
      Object.values(document.runbooks).map((runbook) => runbook.gateId),
    ).toEqual([
      "FE-GATE-021",
      "FE-GATE-022",
      "FE-GATE-023",
      "FE-GATE-024",
      "FE-GATE-025",
    ]);
  });
 });
Author	SHA1	Message	Date
donghyeon-ka	c089e749d0	fix: require genuine live hosting evidence	2026-07-25 22:25:04 +09:00
donghyeon-ka	4667cafa43	fix: validate complete immutable release surface	2026-07-25 21:45:02 +09:00
donghyeon-ka	18bea3a852	fix: verify hosting response content types	2026-07-25 21:43:55 +09:00