phase 16 implementation

2026-06-25 20:08:39 -04:00
parent 5d017f533a
commit c43620a005
248 changed files with 18458 additions and 90 deletions
@@ -0,0 +1,43 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fail, pass, repositoryRoot } from './lib.mjs';
+
+const failures = [];
+const route = await readFile(path.join(repositoryRoot, 'src/app/api/demo/route.ts'), 'utf8');
+const service = await readFile(path.join(repositoryRoot, 'src/lib/demo/service.ts'), 'utf8');
+const environment = await readFile(
+  path.join(repositoryRoot, 'src/lib/integrations/environment.ts'),
+  'utf8',
+);
+
+for (const control of [
+  "request.headers.get('origin')",
+  "request.headers.get('content-type')",
+  "request.headers.get('content-length')",
+  "request.headers.get('x-rdg-form')",
+  'maximumBodyBytes',
+  'demoSubmissionEnvelopeSchema.safeParse',
+  'Cache-Control',
+]) {
+  if (!route.includes(control)) failures.push(`Submission API is missing control: ${control}`);
+}
+if (!service.includes('AbortController'))
+  failures.push('Integration orchestration has no timeout controller.');
+if (!service.includes('executeIdempotent'))
+  failures.push('Integration orchestration bypasses idempotency.');
+if (!environment.includes('DEMO_LOCAL_TEST_MODE'))
+  failures.push('Loopback test escape is not explicit.');
+if (!environment.includes("['127.0.0.1', 'localhost']")) {
+  failures.push('Production-like local adapter escape is not restricted to loopback origins.');
+}
+
+const sourceFiles = [route, service];
+if (sourceFiles.some((source) => /console\.(log|info|debug|warn|error)\s*\(/.test(source))) {
+  failures.push('Submission path writes diagnostics directly to the console.');
+}
+
+if (failures.length) fail(failures);
+else
+  pass(
+    'Phase 14 API boundary includes origin, content-type, size, timeout, idempotency, and no-raw-log controls.',
+  );