code-foundry 1.15.0 → 1.17.0

package/.github/workflows/consumer-qualification.yml

@@ -0,0 +1,95 @@
+name: Consumer Qualification
+
+on:
+  workflow_call:
+    inputs:
+      billing-pause-bypass:
+        description: Allow an explicitly dispatched release to qualify while shared CI remains paused.
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  pack:
+    name: Pack candidate once
+    if: vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      filename: ${{ steps.pack.outputs.filename }}
+    steps:
+      - name: Checkout candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup packaging Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Pack the distributable once
+        id: pack
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/candidate"
+          npm pack --ignore-scripts --json --pack-destination "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/candidate/pack.json"
+          PACKAGE=$(node -e 'const p=require(process.argv[1]); if(p.length!==1 || !/^[A-Za-z0-9._-]+\.tgz$/.test(p[0].filename)) process.exit(1); console.log(p[0].filename)' "$RUNNER_TEMP/candidate/pack.json")
+          echo "filename=$PACKAGE" >> "$GITHUB_OUTPUT"
+      - name: Retain the shared candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: qualification-candidate-${{ github.run_id }}
+          path: ${{ runner.temp }}/candidate/*
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  qualify:
+    name: Node ${{ matrix.node }}
+    needs: pack
+    if: vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['20', '22', '24']
+    steps:
+      - name: Checkout qualification runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Retrieve the shared archive from this attempt
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+            --name "qualification-candidate-$GITHUB_RUN_ID" \
+            --dir "$RUNNER_TEMP/candidate"
+      - name: Install pinned workflow validator
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+      - name: Qualify the exact shared distributable
+        env:
+          PACKAGE: ${{ needs.pack.outputs.filename }}
+        run: |
+          set -euo pipefail
+          node src/lib/consumer-qualification.mjs \
+            "$RUNNER_TEMP/candidate/$PACKAGE" \
+            "$(git rev-parse HEAD)" \
+            "$RUNNER_TEMP/report.json" \
+            "$(go env GOPATH)/bin/actionlint"
+      - name: Retain qualification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: consumer-qualification-${{ github.run_attempt }}-node-${{ matrix.node }}
+          path: ${{ runner.temp }}/report.json
+          if-no-files-found: warn
+          retention-days: 14

package/.github/workflows/consumer-qualification_self-ci.yml

@@ -0,0 +1,19 @@
+name: Qualification
+
+on:
+  pull_request:
+    branches: [main]
+    types: [ready_for_review]
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: qualification-${{ github.event_name }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  consumers:
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
+    uses: ./.github/workflows/consumer-qualification.yml

package/.github/workflows/release_self-ci.yml

@@ -19,8 +19,18 @@ permissions:
   id-token: write
 
 jobs:
+  qualification:
+    name: Qualify consumers
+    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    uses: ./.github/workflows/consumer-qualification.yml
+    with:
+      billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
+    permissions:
+      actions: read
+      contents: read
   release:
     name: Release
+    needs: qualification
     if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
     uses: ./.github/workflows/release.yml
     with:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.17.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.16.0...v1.17.0) (2026-09-09)
+
+
+### Features
+
+* **quality:** add opt-in site, app, Worker, and package acceptance profiles ([#545](https://github.com/0xPlayerOne/code-foundry/issues/545)) ([1201793](https://github.com/0xPlayerOne/code-foundry/commit/1201793805b443c835b608609704bc43bcb035f5))
+
+## [1.16.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.15.0...v1.16.0) (2026-09-09)
+
+
+### Features
+
+* **qualification:** gate releases on installed consumer compatibility ([#544](https://github.com/0xPlayerOne/code-foundry/issues/544)) ([33c759b](https://github.com/0xPlayerOne/code-foundry/commit/33c759be8c78c633f55a58dc6144986758676336))
+
 ## [1.15.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.14.0...v1.15.0) (2026-09-09)
 
 

package/README.md

@@ -39,6 +39,8 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   audits, Draft Guard, Draft PR, Release PR, and Release.
 - A deterministic performance lane with ordered command support, stable result
   artifacts, and an optional shared Node package budget profile.
+- An opt-in product-quality runner for static sites, web apps, Workers, and
+  published packages.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and
   linting.
 - An optional `.mise.toml`/`mise.lock`, repository profile configuration, and

package/docs/PERFORMANCE.md

@@ -15,14 +15,22 @@ belong to the run that produced them, not the source tree.
 | Format, lint, type-check, and build |   15 s | Bound the local CI feedback loop                     |
 | Runtime dependencies                |      0 | Keep the installed CLI dependency-free               |
 | Development dependencies            |      4 | Prevent unreviewed toolchain growth                  |
-| Packed artifact                     | 210 kB | Bound registry transfer and install cost             |
-| Unpacked artifact                   | 820 kB | Bound installed footprint                            |
-| Packed files                        |     92 | Detect accidental release contents                   |
+| Packed artifact                     | 240 kB | Bound registry transfer and install cost             |
+| Unpacked artifact                   | 900 kB | Bound installed footprint                            |
+| Packed files                        |    110 | Detect accidental release contents                   |
 
 The performance workflow disables build-cache reads and writes for this task.
 That makes timing comparisons independent of a warm protected-branch cache and
 prevents benchmark code from populating shared cache entries.
 
+The consumer qualification workflow adds the installed-package harness and
+workflow contract to the distributable. The merged candidate measured 221,495
+packed bytes, 853,573 unpacked bytes, and 100 files on Node 24.18.0; the updated
+budgets leave a small margin while continuing to bound package growth. The
+product-quality profiles and consumer qualification workflow measured 232,650
+packed bytes, 890,418 unpacked bytes, and 103 files on Node 24.18.0, so the
+limits remain intentionally bounded while covering both opt-in feature sets.
+
 ## v1.6.1 baseline
 
 Measurements were taken on 2026-09-08 with Node 24.18.0. Process startup used

package/docs/README.md

@@ -15,6 +15,7 @@ its own names, environments, and deployment details.
 - [Caching and remote caching](CACHING.md)
 - [Performance budgets and baselines](PERFORMANCE.md)
 - [Required capabilities and task evidence](required-capabilities.md)
+- [Product quality profiles](product-quality.md)
 - [Agent-facing validation commands](agent-validation.md)
 - [Declarative fleet inventory and staged rollouts](fleet-rollouts.md)
 

package/docs/consumer-qualification.md

@@ -0,0 +1,48 @@
+# Consumer Qualification
+
+Release-candidate compatibility checks against the distributable package.
+
+**Status:** Opt-in reusable workflow; required by Code Foundry's own release caller.
+**Scope:** Package installation, CLI initialization/synchronization, generated workflow contracts.
+
+`consumer-qualification.yml` packs the checked-out candidate once, shares that archive across all supported
+Node majors using an artifact scoped to the same workflow run (including failed-job reruns), installs it offline with lifecycle scripts disabled,
+and executes its public CLI from the installed package. The harness does not
+import the source checkout's initializer as a substitute for package testing.
+
+The matrix covers npm, pnpm, Yarn, Bun, direct and staging-release topologies,
+authored documentation and workflows, an existing mise selection, and nested
+Rust/Python manifests. It checks detected package managers, byte preservation,
+and two successive no-change synchronizations. Lockfiles are detection fixtures:
+this suite does not claim to install or execute every ecosystem toolchain.
+Repository unit/policy suites and real consumer canaries remain required.
+
+Actionlint checks copies of generated callers against the candidate's local
+reusable workflows. Only exact candidate repository/ref calls are localized;
+production callers and custom workflows are never edited by this step. Shellcheck
+and Pyflakes are disabled here because this gate tests Actions contracts; existing
+shell/security validation remains independent. Actionlint is pinned to v1.7.12.
+
+```sh
+npm pack --ignore-scripts --pack-destination /tmp/candidate
+node src/lib/consumer-qualification.mjs \
+  /tmp/candidate/code-foundry-VERSION.tgz \
+  "$(git rev-parse HEAD)" /tmp/qualification.json /absolute/path/to/actionlint
+```
+
+The JSON report binds the result to the source SHA, archive SHA-256, Node version,
+and completed fixtures. Failed runs retain `complete: false`. Running without
+Actionlint is a local structural probe only (`actionlint: false`), not release
+qualification. Downstream eligibility must require both `complete` and
+`actionlint`, the expected source/digest, and successful reports for every matrix
+member. Reports are evidence, not signatures or a substitute for release identity
+verification.
+
+The self release caller cannot start Release Please or npm publication until all
+qualification jobs succeed. An explicit `release-while-paused` dispatch is passed
+through to the reusable workflow; ordinary calls remain blocked by the billing pause.
+Consumer-generated release callers do not inherit this Code Foundry-specific
+qualification job. This does not yet guarantee that its legacy publishing job uses
+this same archive; the verified-publication workflow handles that separate
+requirement. No branch protections, repository settings, credentials, or consumer
+runtimes are changed by this feature.

package/docs/product-quality.md

@@ -0,0 +1,173 @@
+# Product Quality Profiles
+
+Opt-in acceptance checks for built sites, interactive applications, Workers, and packages.
+
+**Status:** Additive runner; existing repositories are not opted in automatically.
+**Evidence:** Fresh per-run reports under `.code-foundry/quality/`.
+
+## Activation
+
+Commit a version-1 JSON manifest and use the installed, pinned Foundry runtime:
+
+```json
+{
+  "scripts": {
+    "quality:build": "node node_modules/code-foundry/src/quality.mjs .github/product-quality.json build",
+    "quality:browser": "node node_modules/code-foundry/src/quality.mjs .github/product-quality.json browser"
+  }
+}
+```
+
+Wire these scripts into the consumer's existing validation entrypoints. The
+Foundry runtime discovers only `performance:check`/`perf:check` and
+`test:e2e`/`e2e`; if those names do not already exist, they can run
+`bun run quality:build` and `bun run quality:browser`. If they do exist, preserve their current
+commands and compose the quality command after them rather than replacing the
+existing performance or E2E checks. The standalone entrypoint deliberately avoids
+changing the public CLI dispatch being introduced in the separate agent-validation
+PR. Install the reviewed Foundry version in the consumer's existing dependency
+manager and lockfile, not an unpinned network invocation. Add `.code-foundry/` to
+Git/package ignores and retain selected evidence through the consumer workflow's
+artifact uploader. Reports and browser traces may contain application data; review
+retention and never upload authenticated traces publicly without sanitization.
+
+```json
+{
+  "schema_version": 1,
+  "prepare": { "build": [["bun", "run", "build"]] },
+  "profiles": [
+    {
+      "id": "marketing",
+      "type": "static-site",
+      "dist": "dist",
+      "origin": "https://example.com",
+      "routes": [{ "path": "/", "html": "index.html", "javascriptAssets": [] }],
+      "budgets": { "htmlBytes": 100000, "javascriptBytes": 80000, "imageBytes": 600000 },
+      "sitemap": "sitemap.xml",
+      "robots": "robots.txt",
+      "redirects": { "file": "_redirects", "rules": [{ "from": "/old", "to": "/", "status": 301 }] }
+    }
+  ]
+}
+```
+
+Example numbers are not fleet defaults. Measure and review thresholds in the
+consumer repository. `prepare` runs once per selected phase, so several profiles
+can share one build without repeating it. A phase with no applicable profiles
+fails instead of pretending to validate something. Available phases are `build`,
+`browser`, and `deployed`; assign a profile's `phase` explicitly to override its
+default (`browser` for web-app, `build` for the others).
+
+## Static sites
+
+The static profile checks explicit rendered routes for titles, descriptions,
+canonical identity, accidental noindex, local links/anchors, directly referenced
+resources, declared additional JavaScript chunks, sitemap inclusion, robots
+sitemap declaration, and exact simple `_redirects` rules. All responsive image
+candidates count toward the asset budget. Budgets measure build bytes, not an
+estimate of browser transfer size or Core Web Vitals. `javascriptAssets` must
+include transitive chunks selected from the consumer's bundler manifest; this
+runner does not invent a framework dependency graph. External resources fail
+closed rather than being treated as zero-byte dependencies.
+
+This conservative generated-HTML parser is not a browser DOM or a complete HTML
+conformance validator. Complex base-element routing, sitemap indexes, wildcard or
+conditional redirects, client-only metadata, and CDN behavior need repository-owned
+or deployed tests. All generated/public routes should be declared (or the manifest
+generated from the framework's route output) to avoid untested routes. Redirect
+checks prove the artifact declaration, not production routing behavior.
+
+## Interactive applications
+
+```json
+{
+  "id": "application",
+  "type": "web-app",
+  "baseURL": "http://127.0.0.1:4321",
+  "webServerCommand": "bun run preview --host 127.0.0.1",
+  "journeys": "tests/quality-journeys.mjs",
+  "snapshots": "tests/quality-snapshots",
+  "routes": [{ "id": "home", "path": "/", "readySelector": "main h1", "visual": true }]
+}
+```
+
+`baseURL` must be an HTTP(S) origin without a path, query, or fragment; routes
+are root-relative paths on that origin. Use the repository's locked
+`@playwright/test`, `@axe-core/playwright`, and matching Chromium installation.
+No browser tooling is silently downloaded. The runner
+imports the consumer's journey module and requires at least one additional real
+passing test beyond its generated route tests. Skips, flakes, expected-failure
+annotations, incomplete results, and missing routes fail the evidence check.
+Each generated route validates navigation, waits for the declared readiness
+selector, checks page runtime errors, and performs axe WCAG 2/2.1 A/AA checks.
+Automation does not establish complete accessibility compliance.
+
+Selected visual routes compare repository-owned baselines with
+`updateSnapshots: none`. Missing baselines fail; this runner never approves them.
+Create and review baselines separately in the same browser/OS/font environment.
+The generated configuration fixes Chromium, viewport, retries, and screenshot
+animation handling; specialized device/authentication fixtures remain in the
+consumer's journey tests. Remote base URLs require explicit `allowRemote: true`;
+that is consent to network testing, not isolation. Secrets, account fixtures, and
+production-safe test behavior remain the consumer's responsibility.
+
+## Cloudflare Workers
+
+```json
+{
+  "id": "worker",
+  "type": "worker",
+  "buildCommand": ["bun", "run", "worker:bundle", "{output}"],
+  "files": ["worker.js"],
+  "budgets": { "rawBytes": 1000000, "gzipBytes": 250000 },
+  "runtimeCommand": ["bun", "run", "worker:compatibility", "{output}"]
+}
+```
+
+The build command must emit selected bundles into the fresh output directory.
+`{output}` arguments and `CODE_FOUNDRY_QUALITY_OUTPUT_DIR` expose that directory.
+Raw bytes and the sum of individually gzipped files are measured; they are not
+claimed to equal Cloudflare's uploaded aggregate size or startup limits. Use
+locked Wrangler/workerd to test compatibility dates, flags, and bindings in the
+mandatory native runtime command. Production smoke probes belong in the verified
+delivery workflow, not a hidden dependency of the deterministic build phase.
+No Worker, Durable Object, binding, migration, or production resource is created.
+
+## Published packages
+
+```json
+{
+  "id": "package",
+  "type": "package",
+  "imports": ["my-package", "my-package/feature"],
+  "runtimes": ["node"],
+  "offline": true
+}
+```
+
+The package profile packs once without lifecycle scripts, installs that archive
+into an isolated temporary consumer, and exercises declared package exports using
+Node and/or Bun already installed on the runner. Run build/test preparation
+explicitly first. Both install scripts and package lifecycle hooks are disabled;
+packages requiring installation hooks need a separately reviewed specialized
+consumer suite. Runtime dependencies must be cached for the default offline mode;
+`offline: false` explicitly permits normal registry resolution. Temporary package
+installations are removed. Evidence is rejected if it leaks into the package.
+
+## Evidence and trust
+
+Each summary has a unique run ID, manifest hash, phase, source commit/dirty status
+when available, per-profile metrics or failure reasons, and final status. A new
+output directory prevents old reports from becoming current evidence. The source
+fields are descriptive, not a signed dirty-worktree snapshot. Commands are argv
+arrays without shell expansion; repository-owned commands still have the normal
+permissions of the executing process and are not sandboxed. Playwright's optional
+web-server command is its native shell-command interface and must be reviewed.
+
+The runner does not replace Lighthouse CI, native application tests, manual
+accessibility testing, real consumer canaries, or release provenance. Existing
+Lighthouse assertions can remain in repository-owned scripts/preparation; no
+Lighthouse score or threshold is silently introduced by this feature.
+
+References: [Playwright accessibility](https://playwright.dev/docs/accessibility-testing),
+[Playwright snapshot configuration](https://playwright.dev/docs/api/class-testconfig#test-config-update-snapshots).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -242,7 +242,15 @@ export function syncRepository(options) {
     }
     if (file.endsWith('.yml') && file.startsWith('.github/workflows/')) {
       content = Buffer.from(
-        renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef, rustCodeql)
+        renderWorkflow(
+          content.toString('utf8'),
+          config,
+          runtimeRepository,
+          runtimeRef,
+          rustCodeql,
+          file,
+          target === source
+        )
       )
     }
     if (file === '.github/dependabot.yml') {
@@ -537,8 +545,10 @@ function sourcePath(source, file) {
  * @param {string} repository
  * @param {string} ref
  * @param {{ shards: string, threads: string, maxParallel: string }} rustCodeql
+ * @param {string} file
+ * @param {boolean} selfRepository
  */
-function renderWorkflow(content, config, repository, ref, rustCodeql) {
+function renderWorkflow(content, config, repository, ref, rustCodeql, file, selfRepository) {
   const localPrefix = 'uses: ./.github/workflows/'
   const remotePrefix = `uses: ${repository}/.github/workflows/`
   let rendered = content.replaceAll(localPrefix, remotePrefix)
@@ -578,7 +588,15 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
     'release-pr': config.pr_runner ?? config.runner,
     release: config.release_runner ?? config.runner,
   }
-  const workflow = content.match(/\.github\/workflows\/([^/]+)\.yml/)?.[1]
+  const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  // Consumer release callers are generic package release workflows. The
+  // installed-consumer qualification harness is specific to Code Foundry's
+  // own package and must remain in the self workflow rather than being
+  // rendered into every consumer's release caller.
+  if (workflow === 'release' && !selfRepository) {
+    rendered = removeWorkflowBlock(rendered, 'qualification')
+    rendered = removeWorkflowNeed(rendered, 'release', 'qualification')
+  }
   // The staging-release topology validates and scans pull requests against
   // both main and the integration branch; direct repositories only ever
   // target main, so their callers trigger on main alone.
@@ -669,6 +687,26 @@ function removeWorkflowBlock(content, blockId) {
   return lines.join('\n')
 }
 
+/**
+ * Remove a single root-job dependency while preserving the rest of the job.
+ * @param {string} content
+ * @param {string} jobId
+ * @param {string} dependency
+ * @returns {string}
+ */
+function removeWorkflowNeed(content, jobId, dependency) {
+  const lines = content.split('\n')
+  const start = lines.findIndex((line) => line === `  ${jobId}:`)
+  if (start === -1) return content
+  let end = start + 1
+  while (end < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[end])) end += 1
+  const need = lines.findIndex(
+    (line, index) => index > start && index < end && line === `    needs: ${dependency}`
+  )
+  if (need >= 0) lines.splice(need, 1)
+  return lines.join('\n')
+}
+
 /**
  * Dependabot updates land on the repository's integration branch. Direct
  * repositories have no staging branch, so every update targets main. Cargo,