Harden Public Preview pre-visibility gates (#13)

Harden Public Preview validation and repository-independence gates, add adversarial coverage, and repair CI dependency ordering while preserving release preflight boundaries.

Author: tensornull

.github/ACTIONLINT.md

@@ -14,8 +14,9 @@ directory and verifies it against `.github/actionlint-checksums.txt` before
 execution. Set `ACTIONLINT_BIN` to use a separately installed exact-version
 binary.
 
-`actionlint` statically validates workflow syntax, expressions, and embedded
-shell. A passing local run does not emulate GitHub-hosted runners, exercise
-repository settings, prove secret or environment configuration, perform a live
-CometAPI request, or prove npm Trusted Publishing. Those remain separate remote
-evidence.
+`actionlint` statically validates workflow syntax and expressions. Its optional
+ShellCheck integration supplies additional embedded-shell diagnostics only when
+ShellCheck is available on the host. A passing local run does not emulate
+GitHub-hosted runners, exercise repository settings, prove secret or environment
+configuration, perform a live CometAPI request, or prove npm Trusted Publishing.
+Those remain separate remote evidence.

.github/workflows/ci.yml

@@ -30,6 +30,9 @@ jobs:
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 24.x
+          cache: npm
+      - name: Install locked dependencies
+        run: npm ci
       - name: Validate Public Preview content and identity
         run: npm run check:public-preview
       - name: Download the pinned actionlint release
@@ -69,6 +72,7 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Set up Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
@@ -87,6 +91,8 @@ jobs:
         run: npm test
       - name: Scan tracked material for secret patterns
         run: npm run test:secrets
+      - name: Scan current and historical standalone content
+        run: npm run check:standalone-content
       - name: Build ESM and CommonJS outputs
         run: npm run build
       - name: Validate the package shape

.github/workflows/publish.yml

@@ -80,6 +80,13 @@ jobs:
           EOF
 
           echo "release-commit=${release_commit}" >> "$GITHUB_OUTPUT"
+      - name: Set up Node.js 24
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 24.x
+          cache: npm
+      - name: Install validation dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts
       - name: Verify release metadata and derive the npm dist-tag
         id: version
         env:
@@ -93,11 +100,6 @@ jobs:
             --release-prerelease "$RELEASE_IS_PRERELEASE" \
             --require-final \
             --require-releasable-docs >> "$GITHUB_OUTPUT"
-      - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: 24.x
-          cache: npm
       - name: Use a Trusted Publishing-capable npm CLI
         run: npm install --global npm@11.12.1
       - name: Install locked dependencies

AGENTS.md

@@ -171,11 +171,14 @@ npm test
 npm run typecheck
 npm run lint
 npm run format:check
+npm run test:secrets
 npm run test:package
+npm run test:live-contract
 npm run test:fixtures
 npm run test:compat
 npm run check:standalone-content
 npm run check:self-contained
+npm run check:public-preview
 npm run actionlint
 npm run verify
 ```

CHANGELOG.md

@@ -34,6 +34,10 @@ No user-visible changes are currently recorded beyond the initial alpha scope.
   applicable gate.
 - Added standalone-content scanning to the aggregated Public Preview gate and
   encoded the protected, opt-in npm token bootstrap for `0.1.0-alpha.1` only.
+- Hardened pre-visibility evidence by scanning tracked files and reachable Git
+  history for credential patterns, verifying an exact clean `HEAD` copy,
+  requiring substantive public documentation, and exercising every documented
+  live-smoke stream failure state with mocked transport.
 - Made the release workflow the sole npm dist-tag source: prereleases use
   `next`, stable releases use `latest`, and the package manifest has no static
   dist-tag.

CONTRIBUTING.md

@@ -36,11 +36,14 @@ npm test
 npm run typecheck
 npm run lint
 npm run format:check
+npm run test:secrets
 npm run test:package
 npm run test:live-contract
 npm run test:fixtures
 npm run test:compat
+npm run check:standalone-content
 npm run check:self-contained
+npm run check:public-preview
 npm run actionlint
 npm run verify
 ```
@@ -49,7 +52,9 @@ npm run verify
 transport and must not require `COMETAPI_KEY` or access the production API.
 `npm run actionlint` obtains the checksum-pinned tool when it is not already
 installed, then validates workflow syntax and static policy locally. It is not
-evidence that GitHub Actions ran the workflows.
+evidence that GitHub Actions ran the workflows. Run the self-containment gate
+from a clean tracked worktree; it materializes the exact `HEAD` tree and excludes
+untracked local files from the isolated verification copy.
 
 ## Tests and compatibility claims
 

README.md

@@ -183,11 +183,14 @@ npm test
 npm run typecheck
 npm run lint
 npm run format:check
+npm run test:secrets
 npm run test:package
 npm run test:live-contract
 npm run test:fixtures
 npm run test:compat
+npm run check:standalone-content
 npm run check:self-contained
+npm run check:public-preview
 npm run actionlint
 npm run verify
 ```
@@ -196,7 +199,11 @@ npm run verify
 use mocked transport and require no production credential. `npm run actionlint`
 downloads and checksum-verifies the repository-pinned version when needed, then
 performs static workflow validation. It does not prove that a workflow ran
-successfully on GitHub Actions.
+successfully on GitHub Actions. The secret gate scans the current tracked tree
+plus reachable Git blobs, commit and tag messages, and historical paths without
+printing matched values. The self-containment gate requires a clean tracked
+worktree and verifies an exact materialized copy of `HEAD` in an empty temporary
+parent.
 
 ## Project status
 

RELEASING.md

@@ -99,12 +99,14 @@ npm test
 npm run typecheck
 npm run lint
 npm run format:check
+npm run test:secrets
 npm run test:package
 npm run test:live-contract
 npm run test:fixtures
 npm run test:compat
 npm run check:standalone-content
 npm run check:self-contained
+npm run check:public-preview
 npm run actionlint
 npm run verify
 ```
@@ -122,9 +124,22 @@ install the exact artifact, then upload that same file. `npm run test:compat`
 covers the minimum, locked, and applicable canary dependency lanes with ESM and
 CommonJS runtime checks plus `.mts` and `.cts` consumer type checks.
 
-`npm run check:self-contained` copies repository files into an empty temporary
-parent, scans documentation and configuration for outside-root dependencies, and
-runs the documented offline setup and tests from the copied root.
+`npm run test:secrets` fails on a shallow Git clone and scans the current tracked
+tree plus reachable Git blobs, commit and tag messages, and historical paths.
+It reports only the rule and a safe object identifier or path hash rather than a
+matched value.
+
+`npm run check:standalone-content` fails on a shallow Git clone, materializes
+every unique tracked tree reachable from all local refs and `HEAD` without
+honoring export exclusions, and reports the commit and tree for every
+outside-root or private-content violation. In the isolated self-containment copy
+it scans that exact file tree because Git metadata is intentionally absent.
+
+`npm run check:self-contained` requires a clean tracked worktree, materializes
+the exact `HEAD` tree into an empty temporary parent, scans documentation and
+configuration for outside-root dependencies, and runs the documented offline
+setup and tests from the copied root. Untracked local files cannot satisfy a
+missing repository dependency.
 
 `npm run test:live-contract` uses mocked transport to prove the bounded live
 runner rejects empty Chat results and failed, incomplete, or unterminated
@@ -366,4 +381,14 @@ Every release candidate records these evidence layers separately:
 - npm ownership and Trusted Publisher evidence
 - Tag, release, provenance, publication, and post-publication evidence
 
+For a pre-visibility closeout, use the merged private pull request as the
+durable evidence record because a commit cannot contain its own final object
+ID. After merge, add one timeline comment that records the exact final `main`
+commit, the complete local gate results for that commit, pull-request and
+default-branch Node.js 22/24 CI URLs, failed dependency-update dispositions,
+the read-only private/public-only configuration audit, and every skipped or
+unknown boundary. The comment must explicitly confirm that no visibility,
+repository-rule, environment, secret, live API, tag, release, or registry state
+was changed.
+
 Only a publicly installed and verified npm artifact may be called released.