[Alexendros]

Summary

• Sirve tokens + styles.css como /forge-face.css (CSP style-src 'self', sin <style> de Vite).
• Gate !ready / bootError en App; rail/stepper deshabilitados hasta draft.
• Tests responsive leen el stylesheet externo; registro H17.

Test plan

• pnpm --filter @archmaker/web check
• playwright test responsive-layout.playwright.test.ts mock-flow.playwright.test.ts
• vite build emite dist/forge-face.css y link en index.html
• CI verde

---

Note

Medium Risk
Touches CSP asset pipeline and app boot/navigation gates; mis-served CSS or boot logic could leave the UI unstyled or stuck, but scope is web-only with no auth or data-path changes.

Overview
Fixes H17: strict CSP style-src 'self' no longer breaks styling because Vite’s injected <style> tags are replaced by a single same-origin stylesheet /forge-face.css. A new Vite plugin concatenates design tokens and styles.css, serves it in dev, injects the <link> into HTML, and emits the asset on build; the manual token link and import "./styles.css" from the app entry are removed.

Boot gating hardens the shell when catalog/draft setup fails: bootError shows an alert UI, step content only renders after ready, rail/stepper buttons are disabled, and goToStep is blocked until boot succeeds. Playwright responsive tests now assert layout rules from /forge-face.css and expect only the viewport-visible nav control. The forge-integrity findings doc records H17 as fixed.

^{Reviewed by Cursor Bugbot for commit d408cf6. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: d02497a6-c473-4b07-ad8c-3d48472cc7a1)