DongHyeonkaandClaude Opus 5
bdee07a93b
Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.
Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.
What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.
Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
109 lines
3.4 KiB
TypeScript
109 lines
3.4 KiB
TypeScript
import { mkdir, readFile, writeFile } from "node:fs/promises";
|
|
import process from "node:process";
|
|
|
|
import {
|
|
DEPLOYMENT_TARGETS,
|
|
findAdmissionViolations,
|
|
isDeploymentTarget,
|
|
type AdmissionInput,
|
|
} from "../src/contracts/deployment-admission.ts";
|
|
import { parseRuntimeConfigArtifact } from "../src/contracts/release-artifacts.ts";
|
|
|
|
/**
|
|
* §6.4 / FE-GATE-027. Refuses to admit an artifact to an environment it was not
|
|
* built for.
|
|
*
|
|
* Release coherence already proves the artifacts agree with each other. It
|
|
* cannot prove they belong in production, because a local build is coherent
|
|
* with itself: `APP_ENV: local`, `AUTH_MODE: demo` and a loopback API pass
|
|
* every existing gate. This gate closes that by making the destination an
|
|
* explicit, declared input and refusing anything that does not match it.
|
|
*
|
|
* It fails closed in both directions. An undeclared destination is a refusal,
|
|
* not a default, so an artifact can never be admitted by omission; and every
|
|
* rule is stated as a reason to refuse, so an unreadable field cannot pass.
|
|
*/
|
|
|
|
const RUNTIME_CONFIG_PATH = "dist/config.json";
|
|
const RECORD_PATH = "artifacts/release/deployment-admission.json";
|
|
|
|
async function main(): Promise<void> {
|
|
const declared = process.env["RELEASE_TARGET"];
|
|
if (!isDeploymentTarget(declared)) {
|
|
process.stderr.write(
|
|
"release admission refused: RELEASE_TARGET must be declared as one of " +
|
|
`${DEPLOYMENT_TARGETS.join(", ")}; received ${
|
|
declared === undefined ? "nothing" : declared
|
|
}.\n` +
|
|
"An artifact is never admitted by default — name the environment it is for.\n",
|
|
);
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
|
|
let document: unknown;
|
|
try {
|
|
document = JSON.parse(await readFile(RUNTIME_CONFIG_PATH, "utf8"));
|
|
} catch (error) {
|
|
process.stderr.write(
|
|
`release admission refused: ${RUNTIME_CONFIG_PATH} is unreadable: ${
|
|
error instanceof Error ? error.message : String(error)
|
|
}\n`,
|
|
);
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
|
|
let config: AdmissionInput;
|
|
try {
|
|
config = parseRuntimeConfigArtifact(document) as AdmissionInput;
|
|
} catch (error) {
|
|
process.stderr.write(
|
|
`release admission refused: ${RUNTIME_CONFIG_PATH} is not a valid runtime config: ${
|
|
error instanceof Error ? error.message : String(error)
|
|
}\n`,
|
|
);
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
|
|
const violations = findAdmissionViolations(declared, config);
|
|
await mkdir("artifacts/release", { recursive: true });
|
|
await writeFile(
|
|
RECORD_PATH,
|
|
`${JSON.stringify(
|
|
{
|
|
schemaVersion: 1,
|
|
target: declared,
|
|
appEnv: config.APP_ENV,
|
|
authMode: config.AUTH_MODE,
|
|
apiBaseUrl: config.API_BASE_URL,
|
|
buildId: config.BUILD_ID ?? null,
|
|
releaseId: config.RELEASE_ID ?? null,
|
|
status: violations.length === 0 ? "ADMITTED" : "REFUSED",
|
|
violations,
|
|
},
|
|
null,
|
|
2,
|
|
)}\n`,
|
|
"utf8",
|
|
);
|
|
|
|
if (violations.length > 0) {
|
|
process.stderr.write(
|
|
`release admission refused for ${declared}:\n${violations
|
|
.map((violation) => ` ${violation.field}: ${violation.reason}`)
|
|
.join("\n")}\n`,
|
|
);
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
process.stdout.write(
|
|
`release admission: ${declared} ADMITTED ` +
|
|
`(APP_ENV=${config.APP_ENV}, AUTH_MODE=${config.AUTH_MODE}, ` +
|
|
`API=${config.API_BASE_URL}); record at ${RECORD_PATH}\n`,
|
|
);
|
|
}
|
|
|
|
await main();
|