feat(web): compose P5 frontend acceptance

[SuPuHe]

Summary

Compose the A05 intent/status shell with read-only B05 settlement evidence and clearly labeled synthetic C05 recovery evidence. Add hermetic Chromium acceptance coverage and make clean workspace validation reproducible.

Scope and acceptance criteria

• P5 frontend composition is limited to the stated milestone.
• Create/replay/conflict, authorization-denied, unavailable, committed, UNKNOWN, Graph, keyboard, and responsive flows are covered.
• UNKNOWN exposes reconciliation only; settlement evidence has no payment, resend, retry, force, or submission control.
• Clean root and web-package tests resolve workspace UI packages from source without stale dist bundles.
• Playwright artifacts are ignored by Git and Prettier.

Product and security invariants

• Frontend-only composition; settlement submission logic is not added.
• UNKNOWN remains reconciliation-only.
• Service token is memory-only and no secrets are committed or shared with reviewers.

Validation

pnpm build: PASS
pnpm test: PASS — 59 files, 916 tests
pnpm --filter @oneshot/web test: PASS — 31 tests
pnpm test:browser: PASS — 4 Chromium tests
pnpm format:check: PASS after browser run
pnpm lint: PASS
pnpm typecheck: PASS
pnpm check:generated: PASS
pnpm validate:fixtures: PASS

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 7cb629c8b0131c2c5809b594cfb01fa3ca2e8c2e

• Candidate tree SHA: 5e83abf826ea0edbfed5201ca60cb83db80373fe

• Candidate commit SHA: f1cba9023f260f04207489541c279c3df353f113

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings: no blocking findings; human browser click-through remains open.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending

• Remote head commit SHA: pending

• Remote head tree SHA: pending

• Reviewer tool: free-pi-cli

• Reviewer model: pending

• Verdict: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Required CI checks pass.

Risk and rollback

• Residual risks: first CI browser job on Ubuntu; human desktop/mobile click-through; C05 remains synthetic because the frozen API exposes recovery-view rather than the richer timeline schema.
• Rollback: revert commit f1cba9023f260f04207489541c279c3df353f113.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	8014017	Sep 09 2026, 12:24 PM