code-foundry 1.16.0 → 1.18.0

package/.github/workflows/qualified-foundry-publish.yml

@@ -0,0 +1,144 @@
+name: Qualified Foundry Publication
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Published immutable release tag at the caller commit.
+        required: true
+        type: string
+      asset:
+        description: Exact pre-attached Code Foundry npm tarball name.
+        required: true
+        type: string
+      environment:
+        description: Protected GitHub environment for npm publication.
+        required: false
+        default: npm
+        type: string
+    secrets:
+      NPM_TOKEN:
+        required: false
+
+permissions:
+  attestations: read
+  contents: read
+
+jobs:
+  qualify:
+    name: Qualify Node ${{ matrix.node }}
+    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['20', '22', '24']
+    steps:
+      - name: Checkout trusted qualification runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install pinned Actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+      - name: Download and cryptographically verify the release archive
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RELEASE_ASSET: ${{ inputs.asset }}
+        run: |
+          set -euo pipefail
+          node src/commands/qualified-publication.mjs download \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
+            "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/download.json"
+      - name: Qualify those exact bytes
+        env:
+          RELEASE_ASSET: ${{ inputs.asset }}
+        run: |
+          set -euo pipefail
+          node src/lib/consumer-qualification.mjs \
+            "$RUNNER_TEMP/candidate/$RELEASE_ASSET" "$GITHUB_SHA" \
+            "$RUNNER_TEMP/report.json" "$(go env GOPATH)/bin/actionlint"
+      - name: Retain this attempt's qualification report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: qualified-${{ github.run_attempt }}-node-${{ matrix.node }}
+          path: ${{ runner.temp }}/report.json
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    name: Publish qualified archive
+    needs: qualify
+    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    environment: ${{ inputs.environment }}
+    concurrency:
+      group: qualified-foundry-npm-${{ github.repository }}-${{ inputs.tag }}
+      cancel-in-progress: false
+    permissions:
+      actions: read
+      attestations: read
+      contents: read
+      id-token: write
+    env:
+      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
+      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_ASSET: ${{ inputs.asset }}
+    steps:
+      - name: Checkout trusted publication runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node for trusted publishing
+        if: env.HAS_NPM_TOKEN != 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Setup Node for token publishing
+        if: env.HAS_NPM_TOKEN == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+          registry-url: https://registry.npmjs.org
+      - name: Retrieve only this run attempt's evidence
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for node in 20 22 24; do
+            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "qualified-$GITHUB_RUN_ATTEMPT-node-$node" \
+              --dir "$RUNNER_TEMP/reports/$node"
+          done
+          node src/commands/qualified-publication.mjs download \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
+            "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/download.json"
+      - name: Reverify and publish the tested tarball without lifecycle hooks
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          node src/commands/qualified-publication.mjs publish \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
+            "$RUNNER_TEMP/candidate" \
+            "$RUNNER_TEMP/reports/20/report.json" \
+            "$RUNNER_TEMP/reports/22/report.json" \
+            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/publication.json"
+      - name: Retain publication identity
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: qualified-publication-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/publication.json
+          if-no-files-found: warn
+          retention-days: 14

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.18.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.17.0...v1.18.0) (2026-09-09)
+
+
+### Features
+
+* **releases:** stage qualified assets and publish verified identical archives ([#547](https://github.com/0xPlayerOne/code-foundry/issues/547)) ([dffcb83](https://github.com/0xPlayerOne/code-foundry/commit/dffcb834c8ee8c5c2bcba606350276e6a7de58d0))
+
+## [1.17.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.16.0...v1.17.0) (2026-09-09)
+
+
+### Features
+
+* **quality:** add opt-in site, app, Worker, and package acceptance profiles ([#545](https://github.com/0xPlayerOne/code-foundry/issues/545)) ([1201793](https://github.com/0xPlayerOne/code-foundry/commit/1201793805b443c835b608609704bc43bcb035f5))
+
 ## [1.16.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.15.0...v1.16.0) (2026-09-09)
 
 

package/README.md

@@ -39,6 +39,8 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
   audits, Draft Guard, Draft PR, Release PR, and Release.
 - A deterministic performance lane with ordered command support, stable result
   artifacts, and an optional shared Node package budget profile.
+- An opt-in product-quality runner for static sites, web apps, Workers, and
+  published packages.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and
   linting.
 - An optional `.mise.toml`/`mise.lock`, repository profile configuration, and

package/docs/PERFORMANCE.md

@@ -15,9 +15,9 @@ belong to the run that produced them, not the source tree.
 | Format, lint, type-check, and build |   15 s | Bound the local CI feedback loop                     |
 | Runtime dependencies                |      0 | Keep the installed CLI dependency-free               |
 | Development dependencies            |      4 | Prevent unreviewed toolchain growth                  |
-| Packed artifact                     | 225 kB | Bound registry transfer and install cost             |
-| Unpacked artifact                   | 860 kB | Bound installed footprint                            |
-| Packed files                        |    100 | Detect accidental release contents                   |
+| Packed artifact                     | 250 kB | Bound registry transfer and install cost             |
+| Unpacked artifact                   | 930 kB | Bound installed footprint                            |
+| Packed files                        |    110 | Detect accidental release contents                   |
 
 The performance workflow disables build-cache reads and writes for this task.
 That makes timing comparisons independent of a warm protected-branch cache and
@@ -26,7 +26,14 @@ prevents benchmark code from populating shared cache entries.
 The consumer qualification workflow adds the installed-package harness and
 workflow contract to the distributable. The merged candidate measured 221,495
 packed bytes, 853,573 unpacked bytes, and 100 files on Node 24.18.0; the updated
-budgets leave a small margin while continuing to bound package growth.
+budgets leave a small margin while continuing to bound package growth. The
+product-quality profiles and consumer qualification workflow measured 232,650
+packed bytes, 890,418 unpacked bytes, and 103 files on Node 24.18.0, so the
+limits remain intentionally bounded while covering both opt-in feature sets.
+The qualified-publication workflow adds the release staging and publication
+contract to the distributable. This candidate measured 238,816 packed bytes,
+915,957 unpacked bytes, and 106 files on Node 24.18.0; the 250 kB and 930 kB
+limits retain a measured margin while covering the required release path.
 
 ## v1.6.1 baseline
 

package/docs/README.md

@@ -15,6 +15,7 @@ its own names, environments, and deployment details.
 - [Caching and remote caching](CACHING.md)
 - [Performance budgets and baselines](PERFORMANCE.md)
 - [Required capabilities and task evidence](required-capabilities.md)
+- [Product quality profiles](product-quality.md)
 - [Agent-facing validation commands](agent-validation.md)
 - [Declarative fleet inventory and staged rollouts](fleet-rollouts.md)
 

package/docs/product-quality.md

@@ -0,0 +1,173 @@
+# Product Quality Profiles
+
+Opt-in acceptance checks for built sites, interactive applications, Workers, and packages.
+
+**Status:** Additive runner; existing repositories are not opted in automatically.
+**Evidence:** Fresh per-run reports under `.code-foundry/quality/`.
+
+## Activation
+
+Commit a version-1 JSON manifest and use the installed, pinned Foundry runtime:
+
+```json
+{
+  "scripts": {
+    "quality:build": "node node_modules/code-foundry/src/quality.mjs .github/product-quality.json build",
+    "quality:browser": "node node_modules/code-foundry/src/quality.mjs .github/product-quality.json browser"
+  }
+}
+```
+
+Wire these scripts into the consumer's existing validation entrypoints. The
+Foundry runtime discovers only `performance:check`/`perf:check` and
+`test:e2e`/`e2e`; if those names do not already exist, they can run
+`bun run quality:build` and `bun run quality:browser`. If they do exist, preserve their current
+commands and compose the quality command after them rather than replacing the
+existing performance or E2E checks. The standalone entrypoint deliberately avoids
+changing the public CLI dispatch being introduced in the separate agent-validation
+PR. Install the reviewed Foundry version in the consumer's existing dependency
+manager and lockfile, not an unpinned network invocation. Add `.code-foundry/` to
+Git/package ignores and retain selected evidence through the consumer workflow's
+artifact uploader. Reports and browser traces may contain application data; review
+retention and never upload authenticated traces publicly without sanitization.
+
+```json
+{
+  "schema_version": 1,
+  "prepare": { "build": [["bun", "run", "build"]] },
+  "profiles": [
+    {
+      "id": "marketing",
+      "type": "static-site",
+      "dist": "dist",
+      "origin": "https://example.com",
+      "routes": [{ "path": "/", "html": "index.html", "javascriptAssets": [] }],
+      "budgets": { "htmlBytes": 100000, "javascriptBytes": 80000, "imageBytes": 600000 },
+      "sitemap": "sitemap.xml",
+      "robots": "robots.txt",
+      "redirects": { "file": "_redirects", "rules": [{ "from": "/old", "to": "/", "status": 301 }] }
+    }
+  ]
+}
+```
+
+Example numbers are not fleet defaults. Measure and review thresholds in the
+consumer repository. `prepare` runs once per selected phase, so several profiles
+can share one build without repeating it. A phase with no applicable profiles
+fails instead of pretending to validate something. Available phases are `build`,
+`browser`, and `deployed`; assign a profile's `phase` explicitly to override its
+default (`browser` for web-app, `build` for the others).
+
+## Static sites
+
+The static profile checks explicit rendered routes for titles, descriptions,
+canonical identity, accidental noindex, local links/anchors, directly referenced
+resources, declared additional JavaScript chunks, sitemap inclusion, robots
+sitemap declaration, and exact simple `_redirects` rules. All responsive image
+candidates count toward the asset budget. Budgets measure build bytes, not an
+estimate of browser transfer size or Core Web Vitals. `javascriptAssets` must
+include transitive chunks selected from the consumer's bundler manifest; this
+runner does not invent a framework dependency graph. External resources fail
+closed rather than being treated as zero-byte dependencies.
+
+This conservative generated-HTML parser is not a browser DOM or a complete HTML
+conformance validator. Complex base-element routing, sitemap indexes, wildcard or
+conditional redirects, client-only metadata, and CDN behavior need repository-owned
+or deployed tests. All generated/public routes should be declared (or the manifest
+generated from the framework's route output) to avoid untested routes. Redirect
+checks prove the artifact declaration, not production routing behavior.
+
+## Interactive applications
+
+```json
+{
+  "id": "application",
+  "type": "web-app",
+  "baseURL": "http://127.0.0.1:4321",
+  "webServerCommand": "bun run preview --host 127.0.0.1",
+  "journeys": "tests/quality-journeys.mjs",
+  "snapshots": "tests/quality-snapshots",
+  "routes": [{ "id": "home", "path": "/", "readySelector": "main h1", "visual": true }]
+}
+```
+
+`baseURL` must be an HTTP(S) origin without a path, query, or fragment; routes
+are root-relative paths on that origin. Use the repository's locked
+`@playwright/test`, `@axe-core/playwright`, and matching Chromium installation.
+No browser tooling is silently downloaded. The runner
+imports the consumer's journey module and requires at least one additional real
+passing test beyond its generated route tests. Skips, flakes, expected-failure
+annotations, incomplete results, and missing routes fail the evidence check.
+Each generated route validates navigation, waits for the declared readiness
+selector, checks page runtime errors, and performs axe WCAG 2/2.1 A/AA checks.
+Automation does not establish complete accessibility compliance.
+
+Selected visual routes compare repository-owned baselines with
+`updateSnapshots: none`. Missing baselines fail; this runner never approves them.
+Create and review baselines separately in the same browser/OS/font environment.
+The generated configuration fixes Chromium, viewport, retries, and screenshot
+animation handling; specialized device/authentication fixtures remain in the
+consumer's journey tests. Remote base URLs require explicit `allowRemote: true`;
+that is consent to network testing, not isolation. Secrets, account fixtures, and
+production-safe test behavior remain the consumer's responsibility.
+
+## Cloudflare Workers
+
+```json
+{
+  "id": "worker",
+  "type": "worker",
+  "buildCommand": ["bun", "run", "worker:bundle", "{output}"],
+  "files": ["worker.js"],
+  "budgets": { "rawBytes": 1000000, "gzipBytes": 250000 },
+  "runtimeCommand": ["bun", "run", "worker:compatibility", "{output}"]
+}
+```
+
+The build command must emit selected bundles into the fresh output directory.
+`{output}` arguments and `CODE_FOUNDRY_QUALITY_OUTPUT_DIR` expose that directory.
+Raw bytes and the sum of individually gzipped files are measured; they are not
+claimed to equal Cloudflare's uploaded aggregate size or startup limits. Use
+locked Wrangler/workerd to test compatibility dates, flags, and bindings in the
+mandatory native runtime command. Production smoke probes belong in the verified
+delivery workflow, not a hidden dependency of the deterministic build phase.
+No Worker, Durable Object, binding, migration, or production resource is created.
+
+## Published packages
+
+```json
+{
+  "id": "package",
+  "type": "package",
+  "imports": ["my-package", "my-package/feature"],
+  "runtimes": ["node"],
+  "offline": true
+}
+```
+
+The package profile packs once without lifecycle scripts, installs that archive
+into an isolated temporary consumer, and exercises declared package exports using
+Node and/or Bun already installed on the runner. Run build/test preparation
+explicitly first. Both install scripts and package lifecycle hooks are disabled;
+packages requiring installation hooks need a separately reviewed specialized
+consumer suite. Runtime dependencies must be cached for the default offline mode;
+`offline: false` explicitly permits normal registry resolution. Temporary package
+installations are removed. Evidence is rejected if it leaks into the package.
+
+## Evidence and trust
+
+Each summary has a unique run ID, manifest hash, phase, source commit/dirty status
+when available, per-profile metrics or failure reasons, and final status. A new
+output directory prevents old reports from becoming current evidence. The source
+fields are descriptive, not a signed dirty-worktree snapshot. Commands are argv
+arrays without shell expansion; repository-owned commands still have the normal
+permissions of the executing process and are not sandboxed. Playwright's optional
+web-server command is its native shell-command interface and must be reviewed.
+
+The runner does not replace Lighthouse CI, native application tests, manual
+accessibility testing, real consumer canaries, or release provenance. Existing
+Lighthouse assertions can remain in repository-owned scripts/preparation; no
+Lighthouse score or threshold is silently introduced by this feature.
+
+References: [Playwright accessibility](https://playwright.dev/docs/accessibility-testing),
+[Playwright snapshot configuration](https://playwright.dev/docs/api/class-testconfig#test-config-update-snapshots).

package/docs/qualified-publication.md

@@ -0,0 +1,111 @@
+# Qualified Publication
+
+Publish only the same immutable Code Foundry archive that passed consumer qualification.
+
+**Dependencies:** Consumer qualification (#544) and release integrity (#537).
+**Activation:** Opt-in replacement publisher; no existing publisher is silently changed.
+
+The reusable `qualified-foundry-publish.yml` downloads an explicitly named npm
+archive from an already-published immutable release, verifies the release and
+asset attestations against the caller's exact commit, qualifies that same archive
+on Node 20/22/24, and only then admits a protected npm publication job. The final
+job downloads only reports from its own workflow run **and run attempt**, rechecks
+all required fixtures and archive/source identities, repeats cryptographic asset
+verification, validates the package name/version, and publishes the tarball with
+lifecycle scripts disabled. It never publishes a directory or rebuilds the package.
+
+The publishing job uses a GitHub environment, serializes publication for a tag,
+and has no dependency installation/build step. Qualification has no npm credential.
+Normal npm trusted publishing is preferred; an explicit optional token supports
+existing consumers. Configure the trusted publisher for the **actual caller and
+reusable-workflow relationship** before enabling this route. Existing version
+publication is not overwritten: retrying an already-published version fails rather
+than treating a registry conflict or network error as proof of identity.
+
+## Release producer contract
+
+Build and test a package once, attach its tarball to a **draft** release, then
+publish that release with immutability enabled. The archive must contain the
+Code Foundry CLI/templates; this is intentionally not a generic package harness.
+The candidate's `package.json` name must be `code-foundry` and its version must
+match the explicit tag. All qualification modules must exist in the caller commit.
+A recent GitHub CLI with `release verify` and `release verify-asset` is required;
+missing support or authentication errors fail closed.
+
+This workflow blocks npm publication, not a GitHub Release that was already
+published. It does **not** add assets after an immutable release is published.
+The `stage` command implements the draft-asset producer: it verifies qualification,
+checks immutability without changing settings, resolves the existing tag to the
+qualified commit, uploads the archive and digest-bound qualification receipt,
+rechecks uploaded digests, then publishes and verifies the release. It requires
+an existing draft and existing tag; it never creates/moves tags or overwrites
+conflicting assets. Settings permission failures block writes. Matching existing
+assets can resume staging; conflicting assets require manual reconciliation.
+The pre-release gate in #544 supplies the required matrix reports.
+The legacy Release Please workflow creates releases without
+this archive staging step. Wire the new `stage` command into a draft-producing
+caller instead of pointing the old direct-release caller at the new publisher:
+
+```sh
+node src/commands/qualified-publication.mjs stage \
+  "$GITHUB_REPOSITORY" "$TAG" "$SOURCE_SHA" "$ASSET" "$CANDIDATE_DIRECTORY" \
+  "$REPORT_NODE_20" "$REPORT_NODE_22" "$REPORT_NODE_24"
+```
+
+The stage command needs a credential with immutable-setting read, release
+write, and attestation-read access; a normal Actions token may lack the
+administration-read permission.
+No elevated credential is installed or requested automatically. The producer must
+also prevent concurrent tag mutation (for example with protected release-tag
+rules and a single tag-scoped producer); GitHub does not offer an atomic
+"publish this draft only if the tag still resolves to SHA" operation. The final
+verification blocks npm if that invariant is violated, but cannot undo an
+already-published immutable release.
+
+Disable the old npm path before
+activating the replacement to prevent racing publishers. None of those production
+settings or existing release workflows are changed in this PR.
+
+Example caller job after its release producer (illustrative job IDs):
+
+```yaml
+permissions:
+  actions: read
+  attestations: read
+  contents: read
+  id-token: write
+jobs:
+  publish:
+    needs: release-producer
+    uses: ./.github/workflows/qualified-foundry-publish.yml
+    with:
+      tag: ${{ needs.release-producer.outputs.tag }}
+      asset: ${{ needs.release-producer.outputs.npm-asset }}
+      environment: npm
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+```
+
+Only main-branch `push` and `workflow_dispatch` callers are admitted. Pull-request
+events (including fork PRs), release-event shortcuts, and billing-paused runs
+cannot publish through this workflow. The event guard does not itself verify
+branch protection or prohibit a fork's independent main-branch workflow; configure
+branch/environment protections and registry publisher identity separately.
+The tag must resolve to `github.sha`, not a caller-selected old commit. To retry
+an older release after main moves, use a separately reviewed recovery procedure;
+do not weaken the identity gate ad hoc.
+
+## Local policy tests and trust
+
+`node --test test/qualified-publication.test.mjs` uses CLI/verifier fixtures to
+exercise missing matrix members, skipped checks, absent Actionlint, changed
+archives, invalid asset names, wrong package identity, and prevention of npm
+execution before verification. These tests do not establish live GitHub signing,
+OIDC permissions, registry publication, or runner tool availability.
+
+Qualification reports are not standalone signatures: they are trusted only after
+selection from this workflow's successful jobs in the same run attempt. Supplying
+arbitrary local JSON to the library is not a security boundary. The reusable
+workflow and its caller must be reviewed/trusted and protected; repository-owned
+code executes with the permissions of its job. No credentials or production
+resources were configured by adding this feature.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {