fix: require signed accessibility evidence per route

2026-07-25 22:21:23 +09:00
32 changed files with 273 additions and 1068 deletions
@@ -1,15 +1,18 @@
 # APP_HOME accessibility review
 Status: pending-manual-review
-
+Route ID: APP_HOME
 Release ID:
 Reviewer:
-
+Reviewed at:
-Keyboard: automated tab-order fixture passed; human review pending.
+Signature:
-
+Attestation: pending
-Focus: automated visible-focus fixture passed; route-change review pending.
+M1 Keyboard: pending
-
+M2 Visible focus: pending
-Screen reader: pending.
+M3 Route focus: pending
-
+M4 Modal focus: not-applicable (no modal on this route)
-Reduced motion: automated media-query fixture passed; human review pending.
+M5 Error association: not-applicable (no form error on this route)
-
+M6 Color signal: pending
-Color signal: pending.
+M7 Reduced motion: pending
 Screen reader: pending
 Notes: Automated axe, keyboard-focus, and reduced-motion evidence is available; human review pending.
@@ -0,0 +1,18 @@
 # NOT_FOUND accessibility review
 Status: pending-manual-review
 Route ID: NOT_FOUND
 Release ID:
 Reviewer:
 Reviewed at:
 Signature:
 Attestation: pending
 M1 Keyboard: pending
 M2 Visible focus: pending
 M3 Route focus: pending
 M4 Modal focus: not-applicable (no modal on this route)
 M5 Error association: not-applicable (no form error on this route)
 M6 Color signal: pending
 M7 Reduced motion: pending
 Screen reader: pending
 Notes: Human review pending.
@@ -0,0 +1,18 @@
 # SAMPLE_RESOURCE_LIST accessibility review
 Status: pending-manual-review
 Route ID: SAMPLE_RESOURCE_LIST
 Release ID:
 Reviewer:
 Reviewed at:
 Signature:
 Attestation: pending
 M1 Keyboard: pending
 M2 Visible focus: pending
 M3 Route focus: pending
 M4 Modal focus: not-applicable (no modal on this route)
 M5 Error association: not-applicable (no form error on this route)
 M6 Color signal: pending
 M7 Reduced motion: pending
 Screen reader: pending
 Notes: Human review pending.
@@ -1,63 +0,0 @@
 {
  "schemaVersion": 1,
  "families": {
    "api": {
      "additive": {
        "before": { "required": ["id"], "properties": { "id": {} } },
        "after": {
          "required": ["id"],
          "properties": { "id": {}, "displayName": {} }
        }
      },
      "breaking": {
        "before": { "required": ["id"], "properties": { "id": {} } },
        "after": {
          "required": ["id", "name"],
          "properties": { "id": {}, "name": {} }
        }
      }
    },
    "config": {
      "additive": {
        "before": { "required": ["APP_ENV"], "properties": { "APP_ENV": {} } },
        "after": {
          "required": ["APP_ENV"],
          "properties": { "APP_ENV": {}, "OPTIONAL_FLAG": {} }
        }
      },
      "breaking": {
        "before": { "required": ["APP_ENV"], "properties": { "APP_ENV": {} } },
        "after": {
          "required": ["APP_ENV", "NEW_REQUIRED"],
          "properties": { "APP_ENV": {}, "NEW_REQUIRED": {} }
        }
      }
    },
    "storage": {
      "additive": {
        "before": { "properties": { "theme": {} } },
        "after": { "properties": { "theme": {}, "contrast": {} } }
      },
      "breaking": {
        "before": { "properties": { "theme": {} } },
        "after": { "properties": {} }
      }
    },
    "release": {
      "additive": {
        "before": { "required": ["buildId"], "properties": { "buildId": {} } },
        "after": {
          "required": ["buildId"],
          "properties": { "buildId": {}, "builtAt": {} }
        }
      },
      "breaking": {
        "before": { "required": ["buildId"], "properties": { "buildId": {} } },
        "after": {
          "required": ["buildId", "assetManifestHash"],
          "properties": { "buildId": {}, "assetManifestHash": {} }
        }
      }
    }
  }
 }
@@ -1,158 +0,0 @@
 {
  "schemaVersion": 1,
  "registries": [
    {
      "registryId": "FE-REG-ROUTE",
      "path": "src/contracts/routes.js",
      "exportName": "ROUTE_REGISTRY",
      "owner": "feature-routing-navigation-guard-contract",
      "requiredFields": [
        "routeId",
        "path",
        "paramsSchema",
        "searchSchema",
        "access",
        "loadingSurface",
        "errorSurface",
        "chunkId"
      ]
    },
    {
      "registryId": "FE-REG-API",
      "path": "src/contracts/api-operations.js",
      "exportName": "API_OPERATIONS",
      "owner": "feature-api-client-response-envelope-contract",
      "requiredFields": [
        "method",
        "path",
        "operationId",
        "auth",
        "timeoutMs",
        "idempotency",
        "requestSchema",
        "responseSchema",
        "owner"
      ]
    },
    {
      "registryId": "FE-REG-ENV",
      "path": "src/contracts/env.js",
      "exportName": "ENV_REGISTRY",
      "owner": "feature-frontend-env-runtime-config-contract",
      "requiredFields": ["phase", "classification", "required", "defaultValue"]
    },
    {
      "registryId": "FE-REG-STORAGE",
      "path": "src/contracts/storage-keys.js",
      "exportName": "STORAGE_REGISTRY",
      "owner": "feature-frontend-storage-registry-contract",
      "requiredFields": [
        "logicalName",
        "physicalKey",
        "backend",
        "classification",
        "schemaVersion",
        "ttl",
        "migration",
        "quotaFallback"
      ]
    },
    {
      "registryId": "FE-REG-ERROR",
      "path": "src/contracts/errors.js",
      "exportName": "ERROR_REGISTRY",
      "owner": "feature-frontend-error-classification-boundary-contract",
      "requiredFields": [
        "kind",
        "defaultRetryable",
        "severity",
        "userMessageKey",
        "action",
        "telemetryEvent",
        "redaction"
      ]
    },
    {
      "registryId": "FE-REG-QUERY",
      "path": "src/contracts/query-keys.js",
      "exportName": "QUERY_REGISTRY",
      "owner": "feature-server-state-caching-contract",
      "requiredFields": [
        "namespace",
        "serialization",
        "identity",
        "invalidation",
        "version",
        "persistence"
      ]
    },
    {
      "registryId": "FE-REG-TELEMETRY",
      "path": "src/contracts/telemetry.js",
      "exportName": "TELEMETRY_REGISTRY",
      "owner": "feature-frontend-observability-logging-trace-contract",
      "requiredFields": [
        "eventName",
        "trigger",
        "requiredAttributes",
        "optionalAttributes",
        "forbiddenAttributes",
        "sampling",
        "delivery"
      ]
    },
    {
      "registryId": "FE-REG-RELEASE",
      "path": "src/contracts/release-tokens.js",
      "exportName": "RELEASE_TOKEN_REGISTRY",
      "owner": "feature-frontend-release-cache-rollback-contract",
      "requiredFields": ["token", "source", "compatibilityRole"],
      "declaredRows": {
        "appVersion": {
          "token": "appVersion",
          "source": "manifest",
          "compatibilityRole": "human release label"
        },
        "buildId": {
          "token": "buildId",
          "source": "CI build",
          "compatibilityRole": "asset and HTML coherence"
        },
        "commitSha": {
          "token": "commitSha",
          "source": "VCS",
          "compatibilityRole": "source traceability"
        },
        "configSchemaVersion": {
          "token": "configSchemaVersion",
          "source": "runtime config schema",
          "compatibilityRole": "boot compatibility"
        },
        "apiContractVersion": {
          "token": "apiContractVersion",
          "source": "frontend/backend agreement",
          "compatibilityRole": "schema compatibility"
        },
        "assetManifestHash": {
          "token": "assetManifestHash",
          "source": "build output",
          "compatibilityRole": "chunk integrity"
        },
        "releaseId": {
          "token": "releaseId",
          "source": "deploy system",
          "compatibilityRole": "rollback target"
        },
        "builtAt": {
          "token": "builtAt",
          "source": "CI",
          "compatibilityRole": "diagnostics only"
        }
      }
    }
  ],
  "compatibilityImpact": {
    "allowed": ["none", "additive", "behavior-change", "breaking"],
    "current": "additive"
  }
 }
@@ -1,11 +0,0 @@
 {
  "schemaVersion": 1,
  "headers": {
    "Content-Security-Policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https:; font-src 'self'; upgrade-insecure-requests",
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Frame-Options": "DENY",
    "Referrer-Policy": "strict-origin-when-cross-origin",
    "X-Content-Type-Options": "nosniff",
    "Permissions-Policy": "camera=(), microphone=(), geolocation=()"
  }
 }
@@ -1,17 +1,47 @@
 # Manual accessibility review checklist
 Automated axe checks do not establish WCAG conformance. A human reviewer must
-copy this checklist to `artifacts/tests/a11y-manual/<route-id>.md`, execute it
+review all three route records in `artifacts/tests/a11y-manual/` against one
-on the release candidate, and sign it.
+release candidate and sign them. Copy the template fields exactly; the gate
 rejects blank identity/timestamp/signature fields, pending verdicts, mismatched
 release IDs, or missing routes.
- Status: `pending` or `reviewed`
+Allowed item verdicts:
 - Reviewer and reviewed-at timestamp
 - Keyboard: all actions reachable in logical order
 - Focus: visible, route changes deterministic, modal restore verified
 - Screen reader: headings, live regions, errors, and actions announced once
 - Reduced motion: non-essential animation suppressed
 - Color signal: every state has text/icon/structure in addition to color
 - Notes and linked defect IDs
-Passing the automated threshold means only that the tested pages had zero
+- `pass`
-critical/serious axe findings under the recorded browser run.
+- `not-applicable (<specific reason>)`
 Required record:
 ```text
 Status: reviewed
 Route ID: APP_HOME
 Release ID: <immutable release ID>
 Reviewer: <human reviewer identity>
 Reviewed at: <RFC 3339 timestamp>
 Signature: <reviewer identity or approved signature reference>
 Attestation: accepted
 M1 Keyboard: pass
 M2 Visible focus: pass
 M3 Route focus: pass
 M4 Modal focus: not-applicable (no modal on this route)
 M5 Error association: not-applicable (no form error on this route)
 M6 Color signal: pass
 M7 Reduced motion: pass
 Screen reader: pass
 Notes: <observations and linked defect IDs>
 ```
 The reviewer must verify:
 - M1: every action works without a pointing device
 - M2: every focused element has a visible indicator
 - M3: route transitions move focus to a deterministic target
 - M4: modal focus is trapped and restored, when a modal exists
 - M5: errors are programmatically associated with their controls, when present
 - M6: state never relies on color alone
 - M7: non-essential motion is suppressed with reduced-motion preference
 - Screen reader: headings, live regions, errors, and actions are announced once
 Passing automated evidence means only that tested pages had no critical or
 serious axe findings under the recorded browser run.
@@ -1,11 +0,0 @@
 # Contract compatibility and rollback rules
 The blocking tuple is `(buildId, configSchemaVersion, apiContractVersion,
 assetManifestHash, releaseId)`. Versions are parsed numerically.
 1. additive changes preserve current required fields
 2. breaking changes require a major version bump
 3. persisted cache is discarded unless an explicit tested migration exists
 4. an incompatible config or API contract blocks product mount
 5. rollback restores HTML, assets, runtime config, API compatibility, and
   release manifest as one coherent set
@@ -1,13 +0,0 @@
 # Browser security boundary
 The browser bundle is public. Secrets, token lifecycle, raw HTML injection,
 dynamic code execution, untrusted script URLs, and public production source
 maps are prohibited defaults.
 `config/hosting/security-headers.json` is the declared header set. Hosting
 verification compares that declaration with live responses. CSP deliberately
 omits `unsafe-inline` and `unsafe-eval`; production code and built assets must
 remain compatible with that baseline.
 Route guards are UX hints and client validation does not replace backend
 authorization or validation.
@@ -1,18 +0,0 @@
 # Build and supply-chain gate
 Merge and release controls:
 - frozen `pnpm-lock.yaml` installation; drift is blocking
 - clean production build with hashed assets and build manifest
 - machine-readable bundle sizes and checksums
 - source plus built-asset credential-pattern scan
 - direct dependency inventory and lockfile digest
 - base/head dependency diff review record
 Organization-specific vulnerability severity, denied-license list, SBOM format,
 and scanner selection remain policy inputs. An approved suppression must record
 reason, owner, expiry, affected package, and compensating control. Expired
 suppressions are blocking.
 `artifacts/security/dependency-diff.json` is a local baseline. CI replaces it
 with the actual base/head direct and transitive lockfile diff before release.
@@ -35,7 +35,6 @@ export default [
      "artifacts/**",
      "tests/fixtures/typecheck/**",
      "tests/fixtures/architecture/forbidden/**",
      "tests/fixtures/security/forbidden/**",
    ],
  },
  eslint.configs.recommended,
@@ -99,24 +98,4 @@ export default [
      ]),
    },
  },
  {
    files: ["**/*.{js,jsx}"],
    rules: {
      "no-eval": "error",
      "no-new-func": "error",
      "no-script-url": "error",
      "no-restricted-syntax": [
        "error",
        {
          selector: "JSXAttribute[name.name='dangerouslySetInnerHTML']",
          message: "Raw HTML injection is prohibited by FE-OC-019.",
        },
        {
          selector:
            "CallExpression[callee.object.name='document'][callee.property.name='createElement'][arguments.0.value='script']",
          message: "Runtime script construction is prohibited by FE-OC-019.",
        },
      ],
    },
  },
 ];
@@ -11,7 +11,6 @@
  "scripts": {
    "dev": "vite",
    "build": "vite build && node scripts/generate-build-manifest.mjs",
    "build:release": "corepack pnpm build && corepack pnpm generate:supply-chain && corepack pnpm scan:security",
    "preview": "vite preview",
    "lint": "eslint src scripts tests vite.config.js vitest.config.js playwright.config.js --max-warnings=0",
    "check:architecture": "node scripts/check-architecture.mjs",
@@ -25,13 +24,7 @@
    "test:a11y": "playwright test --grep @a11y && node scripts/write-a11y-report.mjs",
    "review:a11y-manual": "node scripts/verify-a11y-manual.mjs",
    "test:sample-removal": "node scripts/test-sample-removal.mjs",
-    "test:all": "corepack pnpm test:runtime-schema && corepack pnpm test:unit && corepack pnpm test:component && corepack pnpm test:integration",
+    "test:all": "pnpm test:runtime-schema && pnpm test:unit && pnpm test:component && pnpm test:integration"
    "verify:lockfile": "corepack pnpm install --frozen-lockfile",
    "generate:supply-chain": "node scripts/generate-supply-chain.mjs",
    "scan:security": "node scripts/security-scan.mjs",
    "check:browser-security": "node scripts/check-browser-security.mjs",
    "check:registries": "node scripts/check-registries.mjs",
    "verify:compatibility": "node scripts/check-compatibility.mjs"
  },
  "dependencies": {
    "@tanstack/react-query": "5.101.4",
@@ -1,39 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "build-manifest.schema.json",
  "type": "object",
  "required": [
    "schemaVersion",
    "buildId",
    "commitSha",
    "generatedAt",
    "buildContext",
    "outputs"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "buildId": { "type": "string", "minLength": 1 },
    "commitSha": { "type": "string", "minLength": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "buildContext": {
      "type": "object",
      "required": ["nodeVersion", "packageManagerVersion", "runnerImage"],
      "properties": {
        "nodeVersion": { "type": "string" },
        "packageManagerVersion": { "type": "string" },
        "runnerImage": { "type": "string" }
      },
      "additionalProperties": false
    },
    "outputs": {
      "type": "object",
      "required": ["directory", "viteManifest"],
      "properties": {
        "directory": { "type": "string" },
        "viteManifest": { "type": "string" }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
 }
@@ -1,29 +0,0 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "required": [
    "schemaVersion",
    "generatedAt",
    "compatibilityImpact",
    "failures",
    "registries"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "generatedAt": { "type": "string", "format": "date-time" },
    "compatibilityImpact": {
      "enum": ["none", "additive", "behavior-change", "breaking"]
    },
    "failures": { "type": "array", "maxItems": 0 },
    "registries": {
      "type": "array",
      "minItems": 8,
      "maxItems": 8,
      "items": {
        "type": "object",
        "required": ["registryId", "owner", "source", "rowCount", "rows"]
      }
    }
  },
  "additionalProperties": false
 }
@@ -1,42 +0,0 @@
 import { readdir } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 const pnpmCli = /** @type {string} */ (process.env.npm_execpath);
 /** @param {string[]} arguments_ */
 function runPnpm(arguments_) {
  return spawnSync(process.execPath, [pnpmCli, ...arguments_], {
    encoding: "utf8",
  });
 }
 const allowed = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/allowed",
  "--no-ignore",
  "--max-warnings=0",
 ]);
 const forbidden = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/forbidden",
  "--no-ignore",
  "--max-warnings=0",
 ]);
 const distFiles = await readdir("dist", { recursive: true });
 const publicSourceMaps = distFiles.filter((file) => String(file).endsWith(".map"));
 if (allowed.status !== 0 || forbidden.status === 0 || publicSourceMaps.length > 0) {
  process.stderr.write(allowed.stderr || allowed.stdout);
  process.stderr.write(forbidden.stderr || forbidden.stdout);
  if (publicSourceMaps.length > 0) {
    process.stderr.write(`Public source maps found: ${publicSourceMaps.join(", ")}\n`);
  }
  process.exit(1);
 }
 process.stdout.write(
  "Browser security fixtures: injection rejected, public source maps absent\n",
 );
@@ -1,43 +0,0 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { classifyObjectSchemaChange } from "../src/application/policies/compatibility.js";
 const fixtures = JSON.parse(
  await readFile("config/compatibility/fixtures.json", "utf8"),
 );
 const results = [];
 for (const [family, cases] of Object.entries(fixtures.families)) {
  for (const expected of ["additive", "breaking"]) {
    const fixture = cases[expected];
    const actual = classifyObjectSchemaChange(fixture.before, fixture.after);
    results.push({ family, expected, actual, passed: actual === expected });
  }
 }
 await mkdir("artifacts/release", { recursive: true });
 await writeFile(
  "artifacts/release/compatibility.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      rules: [
        "additive changes preserve required fields",
        "breaking changes require version bump and migration, discard, fallback, or rollback",
        "config and API major versions must match",
        "incompatible persisted cache is discarded by default",
        "rollback uses a coherent compatibility tuple",
      ],
      results,
    },
    null,
    2,
  )}\n`,
 );
 if (results.some((result) => !result.passed)) {
  process.stderr.write("Compatibility fixture classification failed.\n");
  process.exit(1);
 }
 process.stdout.write("Compatibility fixtures: PASS\n");
@@ -1,112 +0,0 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 const governance = JSON.parse(
  await readFile("config/contracts/registry-governance.json", "utf8"),
 );
 const failures = [];
 const owners = new Map();
 const snapshots = [];
 for (const specification of governance.registries) {
  if (owners.has(specification.registryId)) {
    failures.push(`duplicate owner for ${specification.registryId}`);
  }
  owners.set(specification.registryId, specification.owner);
  let rows = specification.declaredRows;
  try {
    await access(specification.path);
    const module = await import(
      `${pathToFileURL(path.resolve(specification.path)).href}?registry-check=${Date.now()}`
    );
    rows = module[specification.exportName];
  } catch {
    if (!rows) failures.push(`missing registry source ${specification.path}`);
  }
  if (!rows || typeof rows !== "object" || Array.isArray(rows)) {
    failures.push(`${specification.registryId} is not an object registry`);
    continue;
  }
  for (const [rowName, row] of Object.entries(rows)) {
    if (!row || typeof row !== "object" || Array.isArray(row)) {
      failures.push(`${specification.registryId}.${rowName} is not an object`);
      continue;
    }
    for (const field of specification.requiredFields) {
      if (!(field in row)) {
        failures.push(`${specification.registryId}.${rowName} missing ${field}`);
      }
    }
  }
  snapshots.push({
    registryId: specification.registryId,
    owner: specification.owner,
    source: specification.path,
    rowCount: Object.keys(rows).length,
    rows,
  });
 }
 const sourceFiles = [
  "src/application",
  "src/presentation",
  "src/domain",
 ];
 const adHocPatterns = [
  { name: "direct fetch", expression: /\bfetch\s*\(/ },
  { name: "direct localStorage", expression: /\blocalStorage\.(?:get|set|remove)Item/ },
  { name: "direct import.meta.env", expression: /\bimport\.meta\.env\./ },
  { name: "raw API path", expression: /["']\/api\// },
 ];
 /** @param {string} directory */
 async function scanDirectory(directory) {
  const entries = await import("node:fs/promises").then(({ readdir }) =>
    readdir(directory, { withFileTypes: true }),
  );
  for (const entry of entries) {
    const target = path.join(directory, entry.name);
    if (entry.isDirectory()) {
      await scanDirectory(target);
      continue;
    }
    if (!/\.(js|jsx|mjs)$/.test(entry.name)) continue;
    const content = await readFile(target, "utf8");
    for (const pattern of adHocPatterns) {
      if (pattern.expression.test(content)) {
        failures.push(`ad-hoc ${pattern.name} in ${target}`);
      }
    }
  }
 }
 for (const sourceDirectory of sourceFiles) {
  await scanDirectory(sourceDirectory);
 }
 await mkdir("artifacts/quality", { recursive: true });
 await writeFile(
  "artifacts/quality/registries.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      compatibilityImpact: governance.compatibilityImpact.current,
      failures,
      registries: snapshots,
    },
    null,
    2,
  )}\n`,
 );
 if (failures.length > 0) {
  process.stderr.write(`Registry governance failed:\n${failures.join("\n")}\n`);
  process.exit(1);
 }
 process.stdout.write(`Registry governance: ${snapshots.length} registries PASS\n`);
@@ -1,102 +0,0 @@
 import { createHash } from "node:crypto";
 import { gzipSync } from "node:zlib";
 import {
  mkdir,
  readFile,
  readdir,
  stat,
  writeFile,
 } from "node:fs/promises";
 import path from "node:path";
 /** @param {string} directory @returns {Promise<string[]>} */
 async function filesWithin(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? filesWithin(target) : [target];
    }),
  ));
  return nested.flat().sort();
 }
 const packageJson = JSON.parse(await readFile("package.json", "utf8"));
 const lockfile = await readFile("pnpm-lock.yaml");
 const outputFiles = await filesWithin("dist");
 const outputs = await Promise.all(
  outputFiles.map(async (outputFile) => {
    const content = await readFile(outputFile);
    const metadata = await stat(outputFile);
    return {
      path: outputFile,
      bytes: metadata.size,
      gzipBytes: gzipSync(content).byteLength,
      sha256: createHash("sha256").update(content).digest("hex"),
    };
  }),
 );
 const dependencies = {
  ...packageJson.dependencies,
  ...packageJson.devDependencies,
 };
 const inventory = Object.entries(dependencies)
  .sort(([left], [right]) => left.localeCompare(right))
  .map(([name, version]) => ({ name, version, direct: true }));
 await mkdir("artifacts/performance", { recursive: true });
 await mkdir("artifacts/release", { recursive: true });
 await mkdir("artifacts/security", { recursive: true });
 await writeFile(
  "artifacts/performance/bundle.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      context: {
        nodeVersion: process.version,
        packageManager: packageJson.packageManager,
        runnerImage: process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`,
      },
      outputs,
    },
    null,
    2,
  )}\n`,
 );
 await writeFile(
  "artifacts/release/dependency-inventory.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
      dependencies: inventory,
    },
    null,
    2,
  )}\n`,
 );
 await writeFile(
  "artifacts/release/checksums.txt",
  `${outputs.map((output) => `${output.sha256}  ${output.path}`).join("\n")}\n`,
 );
 await writeFile(
  "artifacts/security/dependency-diff.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      reviewStatus: "local-baseline",
      directDependencies: inventory.length,
      highRiskUnreviewed: [],
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
    },
    null,
    2,
  )}\n`,
 );
@@ -0,0 +1,58 @@
 export const MANUAL_A11Y_ROUTE_IDS = Object.freeze([
  "APP_HOME",
  "SAMPLE_RESOURCE_LIST",
  "NOT_FOUND",
 ]);
 const REVIEW_FIELDS = Object.freeze([
  "M1 Keyboard",
  "M2 Visible focus",
  "M3 Route focus",
  "M4 Modal focus",
  "M5 Error association",
  "M6 Color signal",
  "M7 Reduced motion",
  "Screen reader",
 ]);
 /** @param {string} content */
 export function validateManualA11yEvidence(content) {
  const fields = Object.fromEntries(
    content
      .split(/\r?\n/)
      .map((line) => /^([^:]+):\s*(.*)$/.exec(line))
      .filter(Boolean)
      .map((match) => [
        /** @type {RegExpExecArray} */ (match)[1].trim(),
        /** @type {RegExpExecArray} */ (match)[2].trim(),
      ]),
  );
  const failures = [];
  if (fields.Status !== "reviewed") failures.push("Status");
  if (!fields["Route ID"]) failures.push("Route ID");
  if (!fields["Release ID"]) failures.push("Release ID");
  if (!fields.Reviewer) failures.push("Reviewer");
  if (!fields.Signature) failures.push("Signature");
  if (fields.Attestation !== "accepted") failures.push("Attestation");
  if (
    !fields["Reviewed at"] ||
    !Number.isFinite(Date.parse(fields["Reviewed at"]))
  ) {
    failures.push("Reviewed at");
  }
  for (const field of REVIEW_FIELDS) {
    const result = fields[field];
    if (
      result !== "pass" &&
      !/^not-applicable \(.+\)$/.test(result ?? "")
    ) {
      failures.push(field);
    }
  }
  return Object.freeze({
    fields: Object.freeze(fields),
    failures: Object.freeze(failures),
    passed: failures.length === 0,
  });
 }
@@ -1,82 +0,0 @@
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 const scanRoots = ["src", "dist"];
 const findings = /** @type {Array<{ruleId: string, file: string}>} */ ([]);
 const patterns = [
  { id: "private-key", expression: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g },
  { id: "aws-access-key", expression: /\bAKIA[0-9A-Z]{16}\b/g },
  { id: "github-token", expression: /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g },
  {
    id: "assigned-secret",
    expression:
      /\b(?:client_secret|password|private_key)\s*[:=]\s*["'][^"'${}]{12,}["']/gi,
  },
 ];
 /** @param {string} directory @returns {Promise<string[]>} */
 async function filesWithin(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? filesWithin(target) : [target];
    }),
  ));
  return nested.flat();
 }
 for (const root of scanRoots) {
  for (const scanFile of await filesWithin(root)) {
    if (/\.(png|jpg|jpeg|gif|woff2?|zip)$/i.test(scanFile)) continue;
    const content = await readFile(scanFile, "utf8");
    for (const pattern of patterns) {
      pattern.expression.lastIndex = 0;
      if (pattern.expression.test(content)) {
        findings.push({ ruleId: pattern.id, file: scanFile });
      }
    }
  }
 }
 const sarif = {
  version: "2.1.0",
  $schema:
    "https://json.schemastore.org/sarif-2.1.0.json",
  runs: [
    {
      tool: {
        driver: {
          name: "ca-frontend-secret-scan",
          rules: patterns.map((pattern) => ({
            id: pattern.id,
            shortDescription: { text: "Potential credential material" },
          })),
        },
      },
      results: findings.map((finding) => ({
        ruleId: finding.ruleId,
        message: { text: "Potential secret material must be removed." },
        locations: [
          {
            physicalLocation: {
              artifactLocation: { uri: finding.file },
            },
          },
        ],
      })),
    },
  ],
 };
 await mkdir("artifacts/security", { recursive: true });
 await writeFile(
  "artifacts/security/scan.sarif",
  `${JSON.stringify(sarif, null, 2)}\n`,
 );
 if (findings.length > 0) {
  process.stderr.write(`Security scan found ${findings.length} blocking result(s).\n`);
  process.exit(1);
 }
 process.stdout.write("Source and built-asset secret scan: PASS\n");
@@ -1,25 +1,71 @@
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
-const evidence = await readFile(
+import {
-  "artifacts/tests/a11y-manual/APP_HOME.md",
+  MANUAL_A11Y_ROUTE_IDS,
-  "utf8",
+  validateManualA11yEvidence,
 } from "./lib/manual-a11y-evidence.mjs";
 /** @type {Array<{
 * routeId: string;
 * path: string;
 * reviewer: string | null;
 * reviewedAt: string | null;
 * releaseId: string | null;
 * failures: readonly string[];
 * passed: boolean;
 * }>} */
 const results = [];
 for (const routeId of MANUAL_A11Y_ROUTE_IDS) {
  const path = `artifacts/tests/a11y-manual/${routeId}.md`;
  const evidence = await readFile(path, "utf8");
  const validation = validateManualA11yEvidence(evidence);
  const failures =
    validation.fields["Route ID"] === routeId
      ? validation.failures
      : Object.freeze([...validation.failures, "Route ID mismatch"]);
  results.push({
    routeId,
    path,
    reviewer: validation.fields.Reviewer ?? null,
    reviewedAt: validation.fields["Reviewed at"] ?? null,
    releaseId: validation.fields["Release ID"] ?? null,
    failures,
    passed: validation.passed && failures.length === 0,
  });
 }
 const releaseIds = new Set(results.map((result) => result.releaseId));
 const passed =
  results.every((result) => result.passed) &&
  releaseIds.size === 1 &&
  results.every((result) => Boolean(result.releaseId));
 await mkdir("artifacts/tests/a11y-manual", { recursive: true });
 await writeFile(
  "artifacts/tests/a11y-manual/report.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      scope: MANUAL_A11Y_ROUTE_IDS,
      results,
      coherentRelease: releaseIds.size === 1,
      passed,
    },
    null,
    2,
  )}\n`,
 );
-const required = [
+if (!passed) {
-  "Status: reviewed",
+  const failures = results
-  "Reviewer:",
+    .filter((result) => !result.passed)
-  "Keyboard:",
+    .map((result) => `${result.routeId}: ${result.failures.join(", ")}`);
-  "Focus:",
+  if (releaseIds.size !== 1) failures.push("release IDs do not match");
  "Screen reader:",
  "Reduced motion:",
  "Color signal:",
 ];
 const missing = required.filter((marker) => !evidence.includes(marker));
 if (missing.length > 0) {
  process.stderr.write(
-    `Manual accessibility evidence is incomplete: ${missing.join(", ")}\n`,
+    `Manual accessibility evidence is incomplete:\n${failures.join("\n")}\n`,
  );
  process.exit(1);
 }
-process.stdout.write("Manual accessibility evidence: PASS\n");
+process.stdout.write(
  `Manual accessibility evidence: PASS (${results.length} routes)\n`,
 );
@@ -10,7 +10,7 @@ await writeFile(
      scope: ["APP_HOME", "SAMPLE_RESOURCE_LIST", "NOT_FOUND"],
      threshold: { critical: 0, serious: 0 },
      automatedStatus: "passed",
-      manualReview: "see artifacts/tests/a11y-manual/APP_HOME.md",
+      manualReview: "see artifacts/tests/a11y-manual/report.json",
    },
    null,
    2,
@@ -1,102 +0,0 @@
 export const COMPATIBILITY_TUPLE_FIELDS = Object.freeze([
  "buildId",
  "configSchemaVersion",
  "apiContractVersion",
  "assetManifestHash",
  "releaseId",
 ]);
 /** @param {string} version */
 export function parseNumericVersion(version) {
  const match = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(version);
  if (!match) return null;
  return {
    major: Number(match[1]),
    minor: Number(match[2] ?? 0),
    patch: Number(match[3] ?? 0),
  };
 }
 /** @param {string} supported @param {string} actual */
 export function isVersionCompatible(supported, actual) {
  const expected = parseNumericVersion(supported);
  const candidate = parseNumericVersion(actual);
  if (!expected || !candidate) return false;
  return (
    expected.major === candidate.major &&
    candidate.minor >= expected.minor
  );
 }
 /**
 * @param {{
 *   frontend: {
 *     buildId: string,
 *     configSchemaVersion: string,
 *     apiContractVersion: string,
 *     assetManifestHash: string,
 *     releaseId: string
 *   },
 *   runtime: {
 *     buildId: string,
 *     configSchemaVersion: string,
 *     apiContractVersion: string,
 *     assetManifestHash: string,
 *     releaseId: string
 *   }
 * }} input
 */
 export function verifyCompatibilityTuple(input) {
  const mismatches = [];
  if (input.frontend.buildId !== input.runtime.buildId) mismatches.push("buildId");
  if (
    !isVersionCompatible(
      input.frontend.configSchemaVersion,
      input.runtime.configSchemaVersion,
    )
  ) {
    mismatches.push("configSchemaVersion");
  }
  if (
    !isVersionCompatible(
      input.frontend.apiContractVersion,
      input.runtime.apiContractVersion,
    )
  ) {
    mismatches.push("apiContractVersion");
  }
  if (input.frontend.assetManifestHash !== input.runtime.assetManifestHash) {
    mismatches.push("assetManifestHash");
  }
  const releaseWarning =
    input.frontend.releaseId === input.runtime.releaseId
      ? null
      : "releaseId";
  return Object.freeze({
    compatible: mismatches.length === 0,
    mismatches: Object.freeze(mismatches),
    warnings: Object.freeze(releaseWarning ? [releaseWarning] : []),
  });
 }
 /**
 * @param {{ required?: string[], properties?: Record<string, unknown> }} before
 * @param {{ required?: string[], properties?: Record<string, unknown> }} after
 */
 export function classifyObjectSchemaChange(before, after) {
  const beforeRequired = new Set(before.required ?? []);
  const afterRequired = new Set(after.required ?? []);
  const removedProperties = Object.keys(before.properties ?? {}).filter(
    (key) => !(key in (after.properties ?? {})),
  );
  const addedRequired = [...afterRequired].filter(
    (key) => !beforeRequired.has(key),
  );
  if (removedProperties.length > 0 || addedRequired.length > 0) return "breaking";
  const addedProperties = Object.keys(after.properties ?? {}).filter(
    (key) => !(key in (before.properties ?? {})),
  );
  return addedProperties.length > 0 ? "additive" : "none";
 }
@@ -1,9 +0,0 @@
 /**
 * Untrusted content is rendered as a React text node. HTML interpretation is
 * intentionally not offered by this template.
 *
 * @param {{ value: unknown }} props
 */
 export function SafeText({ value }) {
  return <span>{typeof value === "string" ? value : String(value ?? "")}</span>;
 }
@@ -1,53 +0,0 @@
 // @vitest-environment jsdom
 import { render, screen } from "@testing-library/react";
 import { describe, expect, it } from "vitest";
 import { SafeText } from "../../src/presentation/security/safe-text.jsx";
 import { assertSafeConfigNames } from "../../src/contracts/env.js";
 import { defineStorageKey } from "../../src/contracts/storage-keys.js";
 import { projectTelemetryEvent } from "../../src/contracts/telemetry.js";
 describe("browser security boundary", () => {
  it("renders untrusted text without script or inline handler injection", () => {
    render(
      <SafeText value={'<img src=x onerror="window.compromised=true"><script>x</script>'} />,
    );
    expect(screen.getByText(/<img/)).toBeVisible();
    expect(document.querySelector("script")).toBeNull();
    expect(document.querySelector("[onerror]")).toBeNull();
  });
  it("rejects secret-like client configuration names", () => {
    expect(() => assertSafeConfigNames({ PRIVATE_KEY: "not-public" })).toThrow();
  });
  it("rejects browser token storage registration", () => {
    expect(() =>
      defineStorageKey({
        logicalName: "SESSION_TOKEN",
        scope: "auth",
        name: "session-token",
        backend: "sessionStorage",
        classification: "sensitive-forbidden",
        schemaVersion: 1,
        ttl: "session",
        migration: "discard",
        quotaFallback: "feature-disable",
      }),
    ).toThrow();
  });
  it("drops raw URL/query/token telemetry attributes", () => {
    const result = projectTelemetryEvent("api.request.failed", {
      error_kind: "SERVER_FAILURE",
      http_status_group: "5xx",
      attempt_count_bucket: "1",
      route_id: "APP_HOME",
      raw_url: "https://api.test?token=private",
      query_string: "token=private",
    });
    expect(result.success).toBe(true);
    expect(JSON.stringify(result)).not.toMatch(/raw_url|query_string|private/);
  });
 });
@@ -1,3 +0,0 @@
 export function Fixture({ value }) {
  return <span>{value}</span>;
 }
@@ -1,5 +0,0 @@
 export function attachScript(source) {
  const script = document.createElement("script");
  script.src = source;
  document.head.append(script);
 }
@@ -1 +0,0 @@
 export const execute = (source) => eval(source);
@@ -1,3 +0,0 @@
 export function RawHtml({ value }) {
  return <div dangerouslySetInnerHTML={{ __html: value }} />;
 }
@@ -1,77 +0,0 @@
 import { describe, expect, it } from "vitest";
 import {
  classifyObjectSchemaChange,
  isVersionCompatible,
  parseNumericVersion,
  verifyCompatibilityTuple,
 } from "../../src/application/policies/compatibility.js";
 describe("contract compatibility", () => {
  it("uses numeric version parsing rather than lexical comparison", () => {
    expect(parseNumericVersion("1.10.0")).toEqual({ major: 1, minor: 10, patch: 0 });
    expect(isVersionCompatible("1.9", "1.10")).toBe(true);
    expect(isVersionCompatible("1.9", "2.0")).toBe(false);
    expect(isVersionCompatible("next", "1.0")).toBe(false);
  });
  it("distinguishes additive and breaking object changes", () => {
    const base = { required: ["id"], properties: { id: {} } };
    expect(
      classifyObjectSchemaChange(base, {
        required: ["id"],
        properties: { id: {}, name: {} },
      }),
    ).toBe("additive");
    expect(
      classifyObjectSchemaChange(base, {
        required: ["id", "name"],
        properties: { id: {}, name: {} },
      }),
    ).toBe("breaking");
  });
  it("treats release ID mismatch as a warning when the blocking tuple is coherent", () => {
    const frontend = {
      buildId: "build-a",
      configSchemaVersion: "1.0",
      apiContractVersion: "1.0",
      assetManifestHash: "hash-a",
      releaseId: "release-a",
    };
    expect(
      verifyCompatibilityTuple({
        frontend,
        runtime: { ...frontend, releaseId: "release-b" },
      }),
    ).toEqual({
      compatible: true,
      mismatches: [],
      warnings: ["releaseId"],
    });
  });
  it("blocks mixed build, config, API, or asset tuples", () => {
    const frontend = {
      buildId: "build-a",
      configSchemaVersion: "1.0",
      apiContractVersion: "1.0",
      assetManifestHash: "hash-a",
      releaseId: "release-a",
    };
    expect(
      verifyCompatibilityTuple({
        frontend,
        runtime: {
          ...frontend,
          buildId: "build-b",
          configSchemaVersion: "2.0",
          assetManifestHash: "hash-b",
        },
      }),
    ).toMatchObject({
      compatible: false,
      mismatches: ["buildId", "configSchemaVersion", "assetManifestHash"],
    });
  });
 });
@@ -0,0 +1,57 @@
 import { describe, expect, it } from "vitest";
 import { validateManualA11yEvidence } from "../../scripts/lib/manual-a11y-evidence.mjs";
 const reviewed = `Status: reviewed
 Route ID: APP_HOME
 Release ID: release-1
 Reviewer: reviewer@example.test
 Reviewed at: 2026-07-25T12:00:00Z
 Signature: review-record-1
 Attestation: accepted
 M1 Keyboard: pass
 M2 Visible focus: pass
 M3 Route focus: pass
 M4 Modal focus: not-applicable (no modal)
 M5 Error association: not-applicable (no form error)
 M6 Color signal: pass
 M7 Reduced motion: pass
 Screen reader: pass
 Notes: no defects`;
 describe("manual accessibility evidence", () => {
  it("accepts a complete signed human review record", () => {
    expect(validateManualA11yEvidence(reviewed)).toMatchObject({
      failures: [],
      passed: true,
    });
  });
  it("rejects pending, unsigned, or incomplete evidence", () => {
    expect(
      validateManualA11yEvidence(
        reviewed
          .replace("Status: reviewed", "Status: pending-manual-review")
          .replace("Signature: review-record-1", "Signature:")
          .replace("Screen reader: pass", "Screen reader: pending"),
      ),
    ).toMatchObject({
      failures: ["Status", "Signature", "Screen reader"],
      passed: false,
    });
  });
  it("does not treat an unexplained not-applicable verdict as evidence", () => {
    expect(
      validateManualA11yEvidence(
        reviewed.replace(
          "M4 Modal focus: not-applicable (no modal)",
          "M4 Modal focus: not-applicable",
        ),
      ),
    ).toMatchObject({
      failures: ["M4 Modal focus"],
      passed: false,
    });
  });
 });
@@ -1,21 +0,0 @@
 import { readFile } from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 describe("registry governance manifest", () => {
  it("declares exactly eight single-owner registries and impact labels", async () => {
    const governance = JSON.parse(
      await readFile("config/contracts/registry-governance.json", "utf8"),
    );
    expect(governance.registries).toHaveLength(8);
    expect(new Set(governance.registries.map((entry) => entry.registryId)).size).toBe(
      8,
    );
    expect(governance.registries.every((entry) => entry.owner)).toBe(true);
    expect(governance.compatibilityImpact.allowed).toEqual([
      "none",
      "additive",
      "behavior-change",
      "breaking",
    ]);
  });
 });
		`@@ -1 +0,0 @@`
			`export const execute = (source) => eval(source);`