feat: render the contract lattice at build time, verify the sync for real - #144
Merged
Conversation
…real /contracts (PR #139) was 100% client-side JS (fetch + DOM render at page load), so axe/structure-audit/checks only ever saw a "Loading…" placeholder in the static build output — that's why it never went green. data/lattice.json + scripts/gen-lattice.mjs already vendor trellis's signed projection into the build pipeline (#142). This finishes the job: - contracts.html renders the lattice section at build time from data/lattice.json via scripts/gen-contracts.mjs (marker-spliced, offline, deterministic — mirrors gen-registry.mjs's --check pattern), so the static output has real content instead of a loading spinner. - lattice-refresh.yml now actually runs `cosign verify-blob` against trellis's signed status.json before curating it (the prior version's comment claimed this happens in CI; nothing did). Verification runs against the exact bytes curated via gen-lattice.mjs's new --from-file flag, and only a verified + changed projection opens a PR. A pull_request-triggered `check` job (offline) fails if contracts.html drifts from data/lattice.json. - wired contracts.html into build.mjs's static copy + data/nav.jsonld's primary nav; regenerated the structure-audit baseline for the new page. Verified locally: build, axe (10/10 pages, 0 violations), structure-audit, shacl, and the deno contracts gate all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…har description brand-checks' meta.mjs gate (required for every non-40x page) failed: 3 required tags missing. Brought contracts.html's <head> up to the same social/ meta parity as conformance.html (og:*, twitter:*) and shortened the description to 145 chars.
…allback) brand's colour-usage gate only recognizes var(--bs-x) with no fallback argument as "tokenized" — var(--bs-color-forest, #0C5A42) leaves the fallback hex exposed as a raw-colour violation (7 hits: 1x ink, 3x forest, 3x clay-red). Dropped the fallbacks and swapped the ad-hoc #b3261e for the palette's actual --bs-color-clay (the existing danger/red token); --bs-color-ink already covers the intro text color.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/contracts(PR feat: /contracts — the visual lattice, live from the signed projection #139) was 100% client-side JS — the static build output only ever showed a "Loading…" placeholder, which is why axe/structure-audit/checks never went green. This renders it at build time instead.data/lattice.json+scripts/gen-lattice.mjs(feat: pull the org contract lattice into the site build pipeline #142) already vendor trellis's signed projection into the pipeline. This finishes the job:contracts.htmlnow renders that data via a newscripts/gen-contracts.mjs(marker-spliced, offline, deterministic — mirrorsgen-registry.mjs's pattern).lattice-refresh.yml's prior comment claimed the cosign signature was "verified in CI", but nothing actually rancosign verify-blobanywhere. It now does — for real, against the exact bytes curated (via a new--from-fileflag ongen-lattice.mjs) — before ever committing the data. Apull_request-triggeredcheckjob also fails ifcontracts.htmldrifts fromdata/lattice.json.contracts.htmlintobuild.mjs's static copy anddata/nav.jsonld's primary nav; regenerated thestructure-auditbaseline for the new page.Test plan
npm run build— succeeds,contracts.htmlcopied intodist/with real rendered rows (no<script>fetch)npm run axe— 10/10 pages, 0 violations (previously would have failed on the placeholder)npm run structure(--check) — passes against regenerated baselinenpm run shacl— conformsdeno run contract/gate.ts— 0 failingnode scripts/gen-contracts.mjs --check— offline, in sync withdata/lattice.json🤖 Generated with Claude Code