npm - @rubytech/create-sitedesk-code - Versions diffs - 0.1.491 → 0.1.493 - Mend

@rubytech/create-sitedesk-code 0.1.491 → 0.1.493

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (92) hide show

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/gates.test.ts CHANGED Viewed

@@ -1,5 +1,12 @@
 import { describe, it, expect } from "vitest";
-import { gateReconcile, gateMarginLeak, gateSignLink } from "../gates.js";
+import {
+  gateReconcile,
+  gateMarginLeak,
+  gateSignLink,
+  gateHeaderConformance,
+  gateTermsWeight,
+  gateReferenceConsistency,
+} from "../gates.js";
 describe("gateReconcile — displayed total must equal the engine total", () => {
   it("passes when data-quote-total matches", () => {
@@ -62,3 +69,76 @@ describe("gateSignLink — client quote's acceptance anchor must be absolute htt
     expect(gateSignLink('<a data-esign-accept href="/sign">Sign</a>')).toEqual({ pass: false, href: "/sign", reason: "relative" });
   });
 });
+describe("gateHeaderConformance — rendered header must be the declared canonical template verbatim", () => {
+  const TEMPLATE = '<div data-doc-header><img src="data:image/png;base64,AAAAlogoBBBB"><span>Acme Ltd</span></div>';
+  it("skips when the account declares no header template (template null)", () => {
+    expect(gateHeaderConformance("<div data-doc-header>anything</div>", null)).toEqual({ pass: true, skipped: true });
+  });
+  it("skips an empty or whitespace-only template rather than passing everything via includes(\"\")", () => {
+    expect(gateHeaderConformance("<div data-doc-header>anything</div>", "   \n  ")).toEqual({ pass: true, skipped: true });
+  });
+  it("passes when the rendered quote embeds the template verbatim (whitespace-tolerant)", () => {
+    const rendered = `<body>\n  <div data-doc-header>\n    <img src="data:image/png;base64,AAAAlogoBBBB">\n    <span>Acme Ltd</span>\n  </div>\n</body>`;
+    expect(gateHeaderConformance(rendered, TEMPLATE)).toEqual({ pass: true });
+  });
+  it("fails closed when the render marked no header block", () => {
+    expect(gateHeaderConformance("<body><h1>Quote</h1></body>", TEMPLATE)).toEqual({ pass: false, reason: "no-header-marker" });
+  });
+  it("fails a rebuilt approximation whose logo data differs", () => {
+    const rebuilt = '<div data-doc-header><img src="data:image/png;base64,DIFFERENTlogo"><span>Acme Ltd</span></div>';
+    expect(gateHeaderConformance(rebuilt, TEMPLATE)).toEqual({ pass: false, reason: "mismatch" });
+  });
+  it("fails a rebuilt approximation whose element structure differs", () => {
+    const rebuilt = '<div data-doc-header><h2>Acme Ltd</h2></div>';
+    expect(gateHeaderConformance(rebuilt, TEMPLATE)).toEqual({ pass: false, reason: "mismatch" });
+  });
+});
+describe("gateTermsWeight — the terms section must carry no above-normal weight", () => {
+  it("skips when the quote marks no terms section", () => {
+    expect(gateTermsWeight("<body><h1>Quote</h1></body>")).toEqual({ pass: true, skipped: true });
+  });
+  it("passes a terms section in normal weight", () => {
+    expect(gateTermsWeight('<section data-doc-terms><p>Payment due in 30 days.</p></section>')).toEqual({ pass: true });
+  });
+  it("fails a <strong> inside the terms section", () => {
+    expect(gateTermsWeight('<section data-doc-terms><p>Payment <strong>due now</strong>.</p></section>')).toEqual({ pass: false, reason: "bold-in-terms" });
+  });
+  it("fails a <b> inside the terms section", () => {
+    expect(gateTermsWeight('<section data-doc-terms><p><b>Note</b></p></section>')).toEqual({ pass: false, reason: "bold-in-terms" });
+  });
+  it("fails an inline font-weight:bold inside the terms section", () => {
+    expect(gateTermsWeight('<section data-doc-terms><p style="font-weight: bold">x</p></section>')).toEqual({ pass: false, reason: "bold-in-terms" });
+  });
+  it("fails an inline numeric font-weight:700 inside the terms section", () => {
+    expect(gateTermsWeight('<section data-doc-terms><p style="font-weight:700">x</p></section>')).toEqual({ pass: false, reason: "bold-in-terms" });
+  });
+  it("ignores bold outside the terms section", () => {
+    expect(gateTermsWeight('<h1><b>ACME QUOTE</b></h1><section data-doc-terms><p>normal terms</p></section>')).toEqual({ pass: true });
+  });
+  it("catches bold after a nested same-name element (a <div data-doc-terms> nesting a <div>)", () => {
+    // depth-balanced extraction: a non-greedy match would stop at the first
+    // </div> and miss the <strong> that follows the nested container.
+    const html = '<div data-doc-terms><div class="logo"></div><strong>NET 7 DAYS</strong></div>';
+    expect(gateTermsWeight(html)).toEqual({ pass: false, reason: "bold-in-terms" });
+  });
+  it("does not read bold from a sibling element after the terms container closes", () => {
+    const html = '<div data-doc-terms><p>normal terms</p></div><footer><b>Acme</b></footer>';
+    expect(gateTermsWeight(html)).toEqual({ pass: true });
+  });
+});
+describe("gateReferenceConsistency — one document reference across every marked place", () => {
+  it("passes when every data-doc-ref carries the same string", () => {
+    const html = '<header data-doc-ref="1848">…</header><footer data-doc-ref="1848">…</footer><div data-doc-ref="1848">accept</div>';
+    expect(gateReferenceConsistency(html)).toEqual({ pass: true, ref: "1848" });
+  });
+  it("skips when the quote marks no document reference (opt-in like header and terms)", () => {
+    expect(gateReferenceConsistency("<body><h1>Quote</h1></body>")).toEqual({ pass: true, skipped: true });
+  });
+  it("fails when a second variant appears (the 1848/1 class)", () => {
+    const html = '<header data-doc-ref="1848">…</header><div data-doc-ref="1848/1">accept</div>';
+    expect(gateReferenceConsistency(html)).toEqual({ pass: false, reason: "inconsistent", refs: ["1848", "1848/1"] });
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/render-run.test.ts CHANGED Viewed

@@ -60,6 +60,37 @@ process.stdin.on("end", () => {
 });
 `;
+// A no-signer render whose quote carries an above-normal weight inside the
+// marked standing-terms section → terms-weight, fail-closed.
+const BOLD_TERMS = `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures } = JSON.parse(input);
+  const t = figures.total;
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><td data-internal-only>cost 900</td><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    quote: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p><section data-doc-terms><p><strong>NET 7 DAYS</strong></p></section></body></html>',
+  }));
+});
+`;
+// A no-signer render whose quote carries two distinct document references (the
+// 1848/1 class) → ref-inconsistent, fail-closed.
+const REF_BAD = `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures } = JSON.parse(input);
+  const t = figures.total;
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><td data-internal-only>cost 900</td><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    quote: '<html><body><header data-doc-ref="1848">ref</header><p data-quote-total="' + t + '">Total ' + t + '</p><div data-doc-ref="1848/1">accept</div></body></html>',
+  }));
+});
+`;
 let dir: string;
 const figures = { total: 1250, header: { phone: "44700900000" }, lines: [] };
 const signUrl = "https://q.pages.dev/sign";
@@ -75,6 +106,8 @@ beforeAll(() => {
   writeFileSync(join(dir, "quoting", "render-subpenny.mjs"), SUBPENNY);
   writeFileSync(join(dir, "quoting", "render-throw.mjs"), THROW);
   writeFileSync(join(dir, "quoting", "render-nosigner.mjs"), NOSIGNER);
+  writeFileSync(join(dir, "quoting", "render-boldterms.mjs"), BOLD_TERMS);
+  writeFileSync(join(dir, "quoting", "render-refbad.mjs"), REF_BAD);
 });
 afterAll(() => rmSync(dir, { recursive: true, force: true }));
 const rs = (n: string) => join(dir, "quoting", n);
@@ -170,6 +203,71 @@ describe("runRender — a failing gate is fail-closed and atomic (no doc filed)"
   });
 });
+describe("runRender — document-conformance gates over the client quote (fail-closed)", () => {
+  it("terms-weight when the quote's standing-terms section carries bold", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-boldterms.mjs"), figures, jobId: "job-bold" });
+    expect(r).toMatchObject({ ok: false, reason: "terms-weight" });
+    expect(existsSync(join(dir, "memory/users/44700900000/documents/quote-job-bold.html"))).toBe(false);
+    expect(existsSync(receiptPath(dir, "job-bold"))).toBe(false);
+  });
+  it("ref-inconsistent when the quote carries a second document-reference variant (the 1848/1 class)", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-refbad.mjs"), figures, jobId: "job-ref" });
+    expect(r).toMatchObject({ ok: false, reason: "ref-inconsistent" });
+    if (r.ok) return;
+    expect(r.detail).toMatch(/1848.*1848\/1/);
+    expect(existsSync(receiptPath(dir, "job-ref"))).toBe(false);
+  });
+  it("files normally when the quote carries no header template, no terms marker, and one consistent reference (all opt-in gates satisfied or skipped)", async () => {
+    // render-nosigner carries none of the new markers → header/terms skip, ref
+    // skips; the render still files, proving the new gates do not break an
+    // existing render script that has not adopted the markers.
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-nosigner.mjs"), figures, jobId: "job-optin-plain" });
+    expect(r.ok).toBe(true);
+    expect(existsSync(receiptPath(dir, "job-optin-plain"))).toBe(true);
+  });
+});
+describe("runRender — header conformance against a declared canonical template", () => {
+  let hdir: string;
+  const HEADER_TPL = '<div data-doc-header><img src="data:image/png;base64,AAAAlogoBBBB"><span>Acme Ltd</span></div>';
+  const renderEmitting = (headerBlock: string) => `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures } = JSON.parse(input);
+  const t = figures.total;
+  const header = ${JSON.stringify(headerBlock)};
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><td data-internal-only>c</td><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    quote: '<html><body>' + header + '<p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+  }));
+});
+`;
+  beforeAll(() => {
+    hdir = mkdtempSync(join(tmpdir(), "sd-render-hdr-"));
+    mkdirSync(join(hdir, "quoting", "templates"), { recursive: true });
+    writeFileSync(join(hdir, "quoting", "templates", "header.html"), HEADER_TPL);
+    // conforming render embeds the declared template verbatim (whitespace
+    // tolerance is covered by the gates unit test)
+    writeFileSync(join(hdir, "quoting", "render-ok.mjs"), renderEmitting(HEADER_TPL));
+    // rebuilt approximation: structure differs, logo data absent
+    writeFileSync(join(hdir, "quoting", "render-bad.mjs"), renderEmitting('<div data-doc-header><h2>Acme Ltd</h2></div>'));
+  });
+  afterAll(() => rmSync(hdir, { recursive: true, force: true }));
+  it("passes when the rendered header embeds the declared template verbatim", async () => {
+    const r = await runRender({ accountDir: hdir, renderScriptPath: join(hdir, "quoting", "render-ok.mjs"), figures, jobId: "job-hdr-ok" });
+    expect(r.ok).toBe(true);
+    expect(existsSync(receiptPath(hdir, "job-hdr-ok"))).toBe(true);
+  });
+  it("header-mismatch when the header is a rebuilt approximation, not the declared template", async () => {
+    const r = await runRender({ accountDir: hdir, renderScriptPath: join(hdir, "quoting", "render-bad.mjs"), figures, jobId: "job-hdr-bad" });
+    expect(r).toMatchObject({ ok: false, reason: "header-mismatch" });
+    expect(existsSync(receiptPath(hdir, "job-hdr-bad"))).toBe(false);
+  });
+});
 describe("runRender — script faults", () => {
   it("render-absent when the render script is missing", async () => {
     const r = await runRender({ accountDir: dir, renderScriptPath: rs("nope.mjs"), figures, signUrl, jobId });

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/gates.ts CHANGED Viewed

@@ -1,13 +1,19 @@
-// The three deterministic, fail-closed gates quote-render enforces on the HTML
-// the operator's render script emits. They are structural checks over stable
+// The deterministic, fail-closed gates quote-render enforces on the HTML the
+// operator's render script emits. They are structural checks over stable
 // attributes the render script marks — not business content:
 //   data-quote-total   the displayed grand total (reconcile against the engine)
 //   data-internal-only cost/margin-bearing figures (must be absent from client docs)
 //   data-esign-accept  the client quote's Sign-Online anchor (absolute https only)
+//   data-doc-header    the header block (must be the declared canonical template verbatim)
+//   data-doc-terms     the standing-terms section (must carry no above-normal weight)
+//   data-doc-ref       every place the document reference appears (must all agree)
 export interface ReconcileVerdict { pass: boolean; shown?: number }
 export interface LeakVerdict { pass: boolean }
 export interface SignLinkVerdict { pass: boolean; href?: string; reason?: "no-anchor" | "empty" | "fragment" | "non-https" | "relative" }
+export interface HeaderVerdict { pass: boolean; skipped?: boolean; reason?: "no-header-marker" | "mismatch" }
+export interface TermsVerdict { pass: boolean; skipped?: boolean; reason?: "bold-in-terms" }
+export interface RefVerdict { pass: boolean; skipped?: boolean; ref?: string; reason?: "inconsistent"; refs?: string[] }
 /** The document's displayed grand total (data-quote-total) must equal the
  *  engine total at penny precision — money is penny-precise, so a sub-penny
@@ -43,3 +49,81 @@ export function gateSignLink(html: string): SignLinkVerdict {
   if (/^[a-z][a-z0-9+.-]*:/i.test(href)) return { pass: false, href, reason: "non-https" };
   return { pass: false, href, reason: "relative" };
 }
+/** Whitespace-normalise for a structure-and-content comparison that tolerates
+ *  the indentation a template engine adds but nothing else: whitespace between
+ *  tags is insignificant (a compact template vs a pretty-printed render), and
+ *  runs of whitespace inside text collapse to one space. */
+function normaliseHtml(s: string): string {
+  return s.replace(/>\s+</g, "><").replace(/\s+/g, " ").trim();
+}
+/** The rendered quote's header must be the operator's declared canonical header
+ *  (`quoting/templates/header.html`) verbatim — its element structure and its
+ *  embedded logo data, not a rebuilt approximation. The template is passed in
+ *  (null when the account declares none). No template → skip. Template present
+ *  but the render marked no header block → fail closed (an unverifiable header
+ *  is not shipped). Otherwise the template must appear verbatim (whitespace
+ *  tolerant) in the rendered document; a rebuilt header — different structure or
+ *  altered/absent logo data — is not a substring and fails. */
+export function gateHeaderConformance(html: string, template: string | null): HeaderVerdict {
+  // A null or empty/whitespace-only template is "no canonical header declared":
+  // skip, rather than let `includes("")` report a pass that enforced nothing.
+  if (template === null || normaliseHtml(template) === "") return { pass: true, skipped: true };
+  if (!/\bdata-doc-header\b/i.test(html)) return { pass: false, reason: "no-header-marker" };
+  return normaliseHtml(html).includes(normaliseHtml(template)) ? { pass: true } : { pass: false, reason: "mismatch" };
+}
+/** Extract the inner content of the single element the render marks with
+ *  `attr`, matched by **balanced tag depth** so a nested element of the same
+ *  name does not truncate the capture. A non-greedy regex would stop at the
+ *  first same-name close tag, letting a violation that sits after a nested
+ *  `<div>`/`<section>` escape a fail-closed gate; depth-balancing captures the
+ *  container's true extent. null when the marker is absent; on unbalanced HTML
+ *  (a render-script defect) it captures to end, the fail-closed direction. */
+function markedInner(html: string, attr: string): string | null {
+  const open = new RegExp(`<(\\w+)[^>]*\\b${attr}\\b[^>]*>`, "i").exec(html);
+  if (!open) return null;
+  const tag = open[1];
+  const start = open.index + open[0].length;
+  const tagRe = new RegExp(`<(/?)${tag}\\b[^>]*>`, "gi");
+  tagRe.lastIndex = start;
+  let depth = 1;
+  let m: RegExpExecArray | null;
+  while ((m = tagRe.exec(html)) !== null) {
+    if (m[1] === "/") {
+      if (--depth === 0) return html.slice(start, m.index);
+    } else {
+      depth++;
+    }
+  }
+  return html.slice(start);
+}
+/** The standing-terms section (marked `data-doc-terms`) must carry no
+ *  above-normal font weight: no `<b>`/`<strong>` element and no inline
+ *  `font-weight` of bold, bolder, or a numeric 500–900. No terms marker → skip
+ *  (a quote may carry no terms). The check is scoped to the marked section, so
+ *  a bold heading elsewhere in the document does not fail it. */
+export function gateTermsWeight(html: string): TermsVerdict {
+  const terms = markedInner(html, "data-doc-terms");
+  if (terms === null) return { pass: true, skipped: true };
+  const bold = /<b[\s>]/i.test(terms)
+    || /<strong[\s>]/i.test(terms)
+    || /font-weight\s*:\s*(bold|bolder|[5-9]00)\b/i.test(terms);
+  return bold ? { pass: false, reason: "bold-in-terms" } : { pass: true };
+}
+/** Every place the render marks a document reference (`data-doc-ref="<ref>"`)
+ *  must carry the same string. The marker is opt-in like the header and terms
+ *  markers: zero markers → skip (an existing render script that has not adopted
+ *  it is not broken). One distinct value → pass. A second distinct value — the
+ *  `1848/1` class, where the header says `1848` and the acceptance block says
+ *  `1848/1` — fails and reports the distinct values in first-seen order. */
+export function gateReferenceConsistency(html: string): RefVerdict {
+  const refs = [...html.matchAll(/\bdata-doc-ref="([^"]*)"/gi)].map((m) => m[1]);
+  if (refs.length === 0) return { pass: true, skipped: true };
+  const distinct = [...new Set(refs)];
+  if (distinct.length === 1) return { pass: true, ref: distinct[0] };
+  return { pass: false, reason: "inconsistent", refs: distinct };
+}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/render-run.ts CHANGED Viewed

@@ -8,12 +8,28 @@
 // cause-naming fault is returned. "Fail loudly and stop", never a partial issue.
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { gateReconcile, gateMarginLeak, gateSignLink, type SignLinkVerdict } from "./gates.js";
+import {
+  gateReconcile,
+  gateMarginLeak,
+  gateSignLink,
+  gateHeaderConformance,
+  gateTermsWeight,
+  gateReferenceConsistency,
+  type SignLinkVerdict,
+} from "./gates.js";
 import { writeRenderReceipt } from "./render-receipt.js";
-export type RenderFault = "render-absent" | "render-error" | "reconcile-fail" | "margin-leak" | "sign-link";
+export type RenderFault =
+  | "render-absent"
+  | "render-error"
+  | "reconcile-fail"
+  | "margin-leak"
+  | "sign-link"
+  | "header-mismatch"
+  | "terms-weight"
+  | "ref-inconsistent";
 export interface RunRenderArgs {
   accountDir: string;
@@ -114,9 +130,21 @@ export async function runRender(a: RunRenderArgs): Promise<RenderResult> {
   // The verdict is reported only when a signer was requested; null otherwise.
   const signLink: SignLinkVerdict | null = esignRequested ? signVerdict : null;
+  // Document-conformance gates over the issued client quote. The header must be
+  // the account's declared canonical template verbatim (a fixed-path opt-in:
+  // quoting/templates/header.html — absent → the header check is skipped); the
+  // standing-terms section must carry no above-normal weight; and every marked
+  // document reference must agree. Each is fail-closed, so a violation writes no
+  // receipt and the browser-pdf-save gate then refuses the print.
+  const headerTemplatePath = join(a.accountDir, "quoting", "templates", "header.html");
+  const headerTemplate = existsSync(headerTemplatePath) ? readFileSync(headerTemplatePath, "utf8") : null;
+  const header = gateHeaderConformance(html.quote, headerTemplate);
+  const terms = gateTermsWeight(html.quote);
+  const ref = gateReferenceConsistency(html.quote);
   const internalOk = recInternal.pass;
   const breakdownOk = recBreakdown.pass && leakBreakdown.pass;
-  const quoteOk = recQuote.pass && leakQuote.pass && signOk;
+  const quoteOk = recQuote.pass && leakQuote.pass && signOk && header.pass && terms.pass && ref.pass;
   if (!internalOk || !breakdownOk || !quoteOk) {
     // Reason names the first failing gate, in document then gate order.
@@ -127,7 +155,10 @@ export async function runRender(a: RunRenderArgs): Promise<RenderResult> {
     else if (!leakBreakdown.pass) { reason = "margin-leak"; detail = "breakdown carries data-internal-only"; }
     else if (!recQuote.pass) { reason = "reconcile-fail"; detail = `quote total ${recQuote.shown} != engine ${engineTotal}`; }
     else if (!leakQuote.pass) { reason = "margin-leak"; detail = "quote carries data-internal-only"; }
-    else { reason = "sign-link"; detail = signDetail; }
+    else if (!signOk) { reason = "sign-link"; detail = signDetail; }
+    else if (!header.pass) { reason = "header-mismatch"; detail = header.reason === "no-header-marker" ? "quote marked no header block to verify against the declared canonical template" : "quote header does not match the declared canonical template"; }
+    else if (!terms.pass) { reason = "terms-weight"; detail = "quote terms section carries above-normal font weight (bold/strong/font-weight >= 500)"; }
+    else { reason = "ref-inconsistent"; detail = `quote document references disagree: ${(ref.refs ?? []).join(", ")}`; }
     return { ok: false, reason, detail };
   }

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/skills/quotation/references/quote-generation.md CHANGED Viewed

@@ -42,7 +42,7 @@ layout, headings, narrative, charts, page size, contact and terms as their own d
 templates nothing and carries no brand. Generating and maintaining that render script is the build
 half of this skill, exactly as generating the pricing engine is the build half of the compute core.
-The render script marks three stable attributes so the tool gates the output deterministically,
+The render script marks stable attributes so the tool gates the output deterministically,
 whatever the operator's brand or language:
 - **`data-quote-total`** on each document's displayed grand total, carrying the numeric total, so the
@@ -53,19 +53,41 @@ whatever the operator's brand or language:
   present **only when the operator opted the quote into online acceptance** — so the tool asserts the
   acceptance link is live.
-`quote-render` enforces three fail-closed gates before it files anything: **reconcile** (each
-document's `data-quote-total` equals the engine total), **margin-leak** (no `data-internal-only` in the
-client breakdown or client quote), and **link-liveness** (the client quote's `data-esign-accept` href
-is an absolute `https://` URL). Link-liveness runs **only on the opt-in path** — when a `signUrl` was
-passed; on the default, signer-less path the quote must carry no acceptance anchor, and a stray one
-fails closed. If any gate fails the tool files nothing and returns a cause-naming fault
-(`reconcile-fail`, `margin-leak`, `sign-link`, `render-absent`, `render-error`). On success it files
-each document to its scope (below) and returns the three HTML paths plus the gate verdicts.
+Three further attributes let the tool enforce the operator's own document-conformance standards on the
+client quote (see `references/verification.md`, "Verifying the issued document conforms"):
+- **`data-doc-header`** on the header block, so the tool can hold it to the account's declared canonical
+  header template at `quoting/templates/header.html` (verbatim, structure and embedded logo data). The
+  template is a fixed-path opt-in: when the account declares none the header check is skipped.
+- **`data-doc-terms`** on the standing-terms section, so the tool asserts it carries no above-normal
+  weight (no `<b>`/`<strong>`, no inline `font-weight` of bold, bolder, or 500 to 900). No terms marker,
+  no check.
+- **`data-doc-ref="<ref>"`** on every place the document reference appears (header, footers, title,
+  acceptance section), all carrying the same string, so a second variant (the `1848/1` class) fails. No
+  reference marker, no check, so an existing render script is not broken by adopting the marker later.
+These conformance markers are opt-in, exactly like `data-esign-accept`: the gate for a marker runs only
+once the render script emits it (and, for the header, only once the account drops its template file).
+`quote-render` enforces its fail-closed gates before it files anything: **reconcile** (each document's
+`data-quote-total` equals the engine total), **margin-leak** (no `data-internal-only` in the client
+breakdown or client quote), **link-liveness** (the client quote's `data-esign-accept` href is an
+absolute `https://` URL), and the client-quote **document-conformance** gates above (header,
+terms-weight, reference-consistency, each opt-in on its marker). Link-liveness runs **only on the
+opt-in path** — when a `signUrl` was passed; on the default, signer-less path the quote must carry no
+acceptance anchor, and a stray one fails closed. If any gate fails the tool files nothing and returns a
+cause-naming fault (`reconcile-fail`, `margin-leak`, `sign-link`, `header-mismatch`, `terms-weight`,
+`ref-inconsistent`, `render-absent`, `render-error`). On success it files each document to its scope
+(below) and returns the three HTML paths plus the gate verdicts.
 The tool produces **HTML, not PDF**. Print each returned path to PDF with the `browser` plugin as the
 final step: `browser-navigate` to its `file://` URL, then `browser-pdf-save` to a `.pdf` alongside it,
 confirming a non-zero byte count. A Workflow chains `quote-engine-run`, then `quote-render`, then one
-`browser` `browser-pdf-save` step per document.
+`browser` `browser-pdf-save` step per document. A **PostToolUse gate on `browser-pdf-save`** then holds
+the printed client-quote PDF to its two PDF-only conformance checks: its `/URI` count is at least the
+source HTML's absolute-link count, and every embedded `https://` link answers 200. A failure blocks the
+print with `[quote-render] op=bypass reason=pdf-link-conformance`, so a link-stripped or dead-link PDF
+is not sent.
 ## The three documents
@@ -170,9 +192,9 @@ For each returned path, print it the same way as every other business-assistant
 3. confirm a non-zero byte count from the `Saved PDF to <path> (<bytes>)` line before treating the PDF
    as done.
-## The tool enforces the reconciliation and link-liveness gates
+## The tool enforces the reconciliation, link-liveness and document-conformance gates
-`quote-render` runs three fail-closed gates over the rendered HTML before it files any document, so
+`quote-render` runs its fail-closed gates over the rendered HTML before it files any document, so
 these checks are enforced deterministically at render time, not as a separate hand-run step:
 - **reconciliation.** Each document's `data-quote-total` must equal the engine total. A mismatch files
@@ -187,6 +209,13 @@ these checks are enforced deterministically at render time, not as a separate ha
   other signal. On the default, signer-less path (no `signUrl`) the quote must carry **no** acceptance
   anchor at all; a stray anchor also returns `sign-link` (a signer link with no signing page is a dead
   button).
+- **document conformance (opt-in per marker).** The client quote's header must be the account's
+  declared canonical template (`header-mismatch`), its terms section must carry no above-normal weight
+  (`terms-weight`), and every marked document reference must agree (`ref-inconsistent`). Each runs only
+  once the render marks its attribute (and, for the header, once the account declares its template), so
+  a render script that has not adopted a marker is not broken. `references/verification.md` owns why and
+  what each asserts. The two PDF-only conformance checks (link count kept, links live) run afterward in
+  the PostToolUse gate on `browser-pdf-save`, because they need the printed PDF.
 The tool emits one `[quote-render] op=render jobId=… docs=3 internal=… breakdown=… quote=…` line on
 success and `[quote-render] op=fault jobId=… reason=… detail=…` on any gate failure. On success it also

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/skills/quotation/references/verification.md CHANGED Viewed

@@ -49,3 +49,54 @@ execute, a direct invocation that bypasses the persisted `quoting/engine.mjs`
 the quote the operator will actually issue. The tool records each verify as `[quote-engine] op=verify
 jobId=… worst=…`; absence of that line for a method claimed verified is the bypass this discipline
 exists to catch.
+# Verifying the issued document conforms to the operator's standards
+The section above accepts the **method**: that it reproduces the operator's past figures. This
+section accepts the **document**: that the issued quote matches the operator's own presentation
+standards. They are two distinct acceptance disciplines over two different things. A quote can
+reproduce every figure to the penny and still go out with a hand-built header, bold buried in the
+terms, or two different quote numbers on the same page. Those are mechanically checkable, so they are
+checked deterministically rather than left to the eye.
+## The gate runs on the deterministic path, not as a side script
+The conformance checks are enforced where the deterministic render path already runs, so there is no
+second surface an operator can forget. The **HTML checks run inside `quote-render`** (the same tool
+and the same fail-closed sequence as reconcile, margin-leak and link-liveness): a violation files no
+document and writes no render receipt, and the `browser-pdf-save` gate then refuses to print a client
+quote that has no receipt. The **PDF checks run in a PostToolUse gate on `browser-pdf-save`**, because
+they need the printed PDF, which does not exist until that tool runs. A conformance violation is
+therefore surfaced at render or print time, before the draft reaches the operator, not by the operator
+noticing it in a delivered quote.
+## What each check asserts
+Each check is structural, over a stable attribute the operator's render script marks (the same pattern
+as `data-quote-total`), so the gate carries no brand and no business content.
+- **Header is the declared canonical template.** When the account declares a canonical header at the
+  fixed path `quoting/templates/header.html`, the rendered quote's header block (marked
+  `data-doc-header`) must contain that template verbatim, its element structure and its embedded logo
+  data, not a rebuilt approximation. No declared template means the check is skipped.
+- **The terms carry no above-normal weight.** Inside the standing-terms section (marked
+  `data-doc-terms`) there is no `<b>`, no `<strong>`, and no inline `font-weight` of bold, bolder, or a
+  numeric 500 to 900. No terms marker means the check is skipped.
+- **One document reference, everywhere.** Every place the render marks the document reference
+  (`data-doc-ref="<ref>"`) carries the same string. A second variant, the `1848/1` class where the
+  header says `1848` and the acceptance block says `1848/1`, fails. No reference marker means the check
+  is skipped, so a render script that has not yet adopted the marker is not broken.
+- **The PDF keeps every link and each link is live.** The printed PDF's `/URI` annotation count is at
+  least the source HTML's absolute-link count (a rasterised or flattened print that dropped links is
+  caught), and every embedded `https://` link answers 200 (a Sign-Online link that a pending redeploy
+  would 404 is caught before the PDF is sent).
+The signature-asset check for order-class documents is not covered here, because this skill's render
+contract issues quote documents, not orders; it is tracked separately.
+## What a conformance failure tells you
+A failure names the check and the failing value on the tool's fault line (`[quote-render] op=fault
+reason=header-mismatch|terms-weight|ref-inconsistent …`) or the PDF gate's bypass line
+(`[quote-render] op=bypass reason=pdf-link-conformance …`). Fix the render script or the input so the
+document conforms, then re-render. The threshold is never widened; the document is corrected.