feat(readiness): add reproducible validation and security evidence

.env.example

@@ -33,7 +33,9 @@ CRONY_COPILOT_FIXTURE=false
 CRONY_RUNNER_GRACE_SECS=5
 CRONY_RUNNER_CREDENTIAL_TTL_SECS=86400
 CRONY_MODE=development
-CRONY_SECRET_MASTER_KEY_HEX=a5c3f1458279dfb241239378dbefa6b8d2ab32703cba1768343712fd37ac1f04
+# Generate a unique 32-byte key outside source control and load it through trusted host configuration.
+# Do not reuse a committed example value. If an old sample key was deployed, rotate it separately.
+# CRONY_SECRET_MASTER_KEY_HEX=
 CRONY_OBJECT_STORE_BACKEND=local
 CRONY_OBJECT_STORE_LOCAL_ROOT=./output/artifact-objects
 CRONY_ARTIFACT_MAX_BYTES=16777216

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Routing only: require-code-owner-review must be enabled separately in native rules.
+* @All-The-Vibes/ecorp-team

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/skills/readiness-improvement/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: readiness-improvement
+description: Improve repository readiness through evidence-backed local validation and the installed CodeBlend evaluator, without claiming hosted authority.
+---
+
+# Readiness improvement
+
+Use an isolated contribution worktree and read the root AGENTS.md contracts first.
+Do not duplicate the shared review workflow proposed in PR #304. This skill only
+defines the readiness measurement/change loop; it grants no tools or permissions.
+
+1. Resolve the current worktree, HEAD and dirty state. Synchronize the approved branch
+   before a batch, never during a benchmark. Preserve all unrelated work.
+2. Use the separately installed `codeblend-ai-composite` skill and its native executable.
+   Evaluate the local path, not the remote URL. Record the evaluator digest, platform,
+   CLI compatibility, models, evidence window and source identity. Never edit scores.
+3. Read actual findings, distinguish unsupported detection from missing engineering,
+   and propose one bounded change with an acceptance test. Keep native Node/Cargo test
+   semantics; never rename or add dummy tests to improve a filename heuristic.
+4. Preview `pnpm check:preview`, implement the approved local scope, then run focused
+   regressions and `pnpm check`. Review machine-readable `output/readiness/` receipts.
+   Failed, cancelled, ignored and unexecuted tests remain separate from passes.
+5. Re-run the same evaluator settings after a meaningful validated batch. Record every
+   attempted result, including regressions and errors, in `docs/AI_READINESS.md`.
+
+Bound each invocation to at most **three meaningful change/measurement cycles**.
+Stop earlier after two cycles without evidence-backed progress, on cancellation,
+ambiguous ownership, a safety failure, or a required external permission. Summarize
+remaining work for an explicitly authorized continuation; do not loop on random judge variance.
+The user's larger objective is not proof that a mathematical maximum has been reached.
+
+Never enable live credentials, widen permissions, change branch rules, publish, merge,
+or deploy as a score optimization. Document these dependencies for the responsible owner.
+Installing a workflow is not evidence it ran, and local results do not establish
+production identity, real-provider reliability or recurring hosted operation.
+
+Use the existing deterministic docs tool for its exact generated contract only:
+`pnpm check:docs:preview`, review, `pnpm check:docs:write`, `pnpm check:docs`.
+It does not repair arbitrary prose or make repository-wide semantic drift claims.

.github/workflows/ci.yml

@@ -11,28 +11,34 @@ permissions:
 jobs:
   quality:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable action; compiler pinned below
         with:
+          toolchain: 1.98.1
           components: rustfmt, clippy
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 11.19.0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: pnpm
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: pnpm install --frozen-lockfile
-      - run: node tools/check_migrations.mjs
-      - name: Verify external-adapter E2E expectations cannot hide runtime failures
-        run: node --test tools/e2e_external_adapters.test.mjs tools/fixture_source_identity.test.mjs tools/owned_test_stack.test.mjs
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy --workspace --all-targets -- -D warnings
-      - run: cargo test --workspace
-      - run: pnpm build:web
-      - run: pnpm lint:web
+      - name: Install the optional steward test SDK from its committed lockfile
+        run: npm ci --prefix scenarios/repo-steward --ignore-scripts --no-audit --no-fund
+      - name: Validate migrations, documentation drift, native tests, Rust and web
+        run: pnpm check
+      - name: Upload machine-readable validation report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: validation-report
+          path: output/readiness/*.json
+          if-no-files-found: warn
+          retention-days: 14
 
   integration:
     runs-on: ubuntu-latest
@@ -57,18 +63,20 @@ jobs:
           --health-timeout 3s
           --health-retries 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: pnpm/action-setup@v4
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable action; compiler pinned below
+        with:
+          toolchain: 1.98.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 11.19.0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: pnpm
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: pnpm install --frozen-lockfile
       - run: cargo build -p crony-server -p crony-runner -p crony-cli -p crony-gateways
       - name: Start control and execution planes
@@ -213,7 +221,7 @@ jobs:
         run: node tools/e2e_chaos_report.mjs
       - name: Upload runtime evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: integration-evidence
           path: |
@@ -266,32 +274,36 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable action; compiler pinned below
+        with:
+          toolchain: 1.98.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 22
-      - uses: Swatinem/rust-cache@v2
+          node-version-file: .node-version
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: cargo test -p crony-runner
       - run: node tools/platform_runner_contract.mjs
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: runner-platform-${{ matrix.os }}
           path: output/platform/*
 
   desktop-windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable action; compiler pinned below
+        with:
+          toolchain: 1.98.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 11.19.0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 22
+          node-version-file: .node-version
           cache: pnpm
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
       - run: pnpm install --frozen-lockfile
       - run: pnpm build:web
       - run: cargo install tauri-cli --version 2.11.4 --locked

.github/workflows/security.yml

@@ -0,0 +1,52 @@
+name: Security
+
+# CodeQL is managed by the repository's existing native default setup for Actions,
+# JavaScript/TypeScript, Python and Rust. Do not add a conflicting advanced upload job.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secrets:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Install checksum-pinned Gitleaks CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/gitleaks"
+          curl --fail --silent --show-error --location --proto '=https' \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \
+            -o "$RUNNER_TEMP/gitleaks/gitleaks.tar.gz"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $RUNNER_TEMP/gitleaks/gitleaks.tar.gz" | sha256sum --check --strict
+          tar -xzf "$RUNNER_TEMP/gitleaks/gitleaks.tar.gz" -C "$RUNNER_TEMP/gitleaks" gitleaks
+      - name: Scan source snapshot for secrets (redacted)
+        shell: bash
+        run: |
+          mkdir -p output/security
+          "$RUNNER_TEMP/gitleaks/gitleaks" dir . --config .gitleaks.toml \
+            --redact=100 --no-banner --report-format json --report-path output/security/gitleaks.json
+      - name: Prove detector rejection and redacted output using synthetic canary
+        run: node tools/security_canary.mjs "$RUNNER_TEMP/gitleaks/gitleaks"
+      - name: Retain redacted security report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: secret-scan-report
+          path: output/security/gitleaks.json
+          if-no-files-found: warn
+          retention-days: 7

.gitleaks.toml

@@ -0,0 +1,22 @@
+title = "ECorp source secret detection"
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Generated dependencies, build output, Git metadata and local evidence are not repository source"
+paths = ['''(^|[\\/])(node_modules|target|target-audit|\.git|output)[\\/]''']
+
+# These exact historical fixture fields identify replay operations, not credentials.
+# Do not ignore entire evidence directories or API-key-shaped values elsewhere.
+[[rules]]
+id = "generic-api-key"
+[[rules.allowlists]]
+description = "Non-secret fixture/replay identifiers in three reviewed test artifacts"
+condition = "AND"
+paths = [
+  '''^docs/evidence/2026-09-08-room-context-browser\.json$''',
+  '''^docs/evidence/assets/predispatch-failure/runtime\.json$''',
+  '''^tools/e2e_factory_run_activity\.py$''',
+]
+regexTarget = "match"
+regexes = ['''(idempotency_key|fixture_key)["']?\s*:\s*["']''']

.node-version

@@ -0,0 +1 @@
+24.19.0

.pre-commit-config.yaml

@@ -0,0 +1,22 @@
+# Optional local feedback. CI executes the same checks without relying on hook installation.
+repos:
+  - repo: local
+    hooks:
+      - id: documentation-contract
+        name: Check documented validation contract
+        entry: node tools/check_docs.mjs
+        language: system
+        pass_filenames: false
+        always_run: true
+      - id: rust-format
+        name: Check Rust formatting without editing files
+        entry: cargo fmt --check
+        language: system
+        pass_filenames: false
+        types: [rust]
+      - id: readiness-tool-tests
+        name: Check validation and evidence tooling
+        entry: node --test tools/readiness_contract.test.mjs
+        language: system
+        pass_filenames: false
+        files: '^(tools/(run_checks|check_docs|readiness_contract\.test)\.mjs|test\.config\.json)$'

README.md

@@ -206,6 +206,11 @@ pnpm check
 
 This runs migration checks, Rust formatting, Clippy, the workspace test suite, and the web build and lint.
 
+It also runs the native Node regression suites and the documentation-contract drift gate.
+Use `pnpm check:preview` to inspect the exact commands without executing them, or
+`pnpm check:fast` for quick feedback. See [reproducible validation](docs/VALIDATION.md)
+for pinned toolchains, test discovery, evidence receipts, and ignored-test boundaries.
+
 ## Run a GitHub issue through the factory
 
 [ECorp Build, organization GitHub Project #5](https://github.com/orgs/All-The-Vibes/projects/5) is

apps/web/AGENTS.md

@@ -0,0 +1,17 @@
+# Web contribution context
+
+The root AGENTS.md and product/security contracts still apply.
+
+- Start with the relevant pure projection/reader beside App.tsx, not the entire UI file.
+- Run `pnpm test:js` from the repository root; Node 24 executes the existing `.test.mjs`
+  suites and their TypeScript imports. `pnpm build:web` type-checks and builds;
+  `pnpm lint:web` checks the web source. See `docs/VALIDATION.md` at the repo root.
+- Server snapshots, exact context readers and persisted run IDs are authoritative.
+  Missing/denied/incomplete context stays unknown; do not substitute another run or viewer.
+- Scope state by server, Corp, actor, room/mission and selected source where applicable.
+  A remembered run ID grants no authority. Comments are not approvals or steering commands.
+- Keep mission, task, run, producer and verifier identities distinct in evidence views.
+- For changed user-visible behavior, verify the browser-to-server-to-runner path in an owned
+  isolated stack, including reconnect and 390px layout. SSR/unit success is not that proof.
+- Coordinate changes to App.tsx with active UI work; extract a bounded responsibility only
+  with regression coverage. Do not rewrite shared schemas or lockfiles incidentally.

crates/AGENTS.md

@@ -0,0 +1,18 @@
+# Rust contribution context
+
+The root AGENTS.md and product/security contracts still apply.
+
+- Domain contains pure policies; protocol contains wire DTOs; store owns transactional
+  persistence; server owns authenticated control; runner owns isolated execution; CLI and
+  gateways adapt supported native operations. Preserve these boundaries.
+- Start with the affected crate's Cargo.toml and relevant module. Use a focused package/test
+  filter first, then `cargo fmt --check`, workspace Clippy and workspace tests before committing.
+- The compiler toolchain is pinned in rust-toolchain.toml; Cargo.lock remains authoritative.
+- Inline tests and macro-generated cases are real Rust tests. Filename or annotation counts
+  are not execution counts. Report passed, failed and ignored results separately.
+- SQLx tests marked ignored require explicitly owned disposable fixtures. Never inherit a
+  retained application's database just to run them. Native-session probes remain opt-in.
+- Prefer native harness capabilities and existing recovery/approval operations over parallel
+  orchestration machinery. Scope admission by Corp, actor, run, source and current authority.
+- Completion needs persisted verifier evidence. A code path, configured gate or successful
+  unit test does not establish real-provider, hosted or production acceptance.