[daliu]

Outcome

Replaces the mutating, ignored frontend lint line with a direct, blocking, non-mutating gate. The reviewable baseline records all 102 frontend files and all 125 configured errors plus 7 warnings after disabling the repository-wide severity-masking hook inside this process.

Closes #186
Parent: #105

Security invariant

• exact scanned files and individual findings must match; count-only replacement is rejected
• fatal parser/configuration/process failures reject through one fixed redacted result
• hosted lint runs directly before application tests
• the guarded prefix pins ubuntu-latest, read-only permission, credential-free checkout, Node 20, lifecycle-disabled install, lint, then clean verification
• structural tests reject duplicate YAML keys, self-hosted runners, global/job/step overrides, inserted environment steps, reordering, failure swallowing, mutation, and incomplete extension coverage
• the clean proof covers tracked and non-ignored untracked files; ignored dependency/build paths and OS-level sandboxing are explicitly outside this slice

Evidence on exact head 0bb164904fb6a8352c6141fc44ff7cd30425e750

Local Node 20:

• fresh lockfile install with lifecycle scripts disabled: passed
• direct lint: 102 files / 125 configured errors / 7 warnings
• workflow/release/artifact tests: 42/42
• frontend Jest: 10 suites / 133 tests
• SPA callback suite: 10/10
• Functions lint: passed
• Functions unit suites: 990 passed / 32 skipped
• Firestore Rules emulator: 317/317 on Java 17
• commerce journal emulator: 31/31 on Java 17
• diagnostic production build: passed
• deliberate malformed TSX: fixed failure, nonzero exit, probe removed
• hostile configuration getter/Proxy: only fixed frontend_lint_gate_failed:lint_rejected, probe removed
• exact post-commit lint + tracked/non-ignored-untracked clean check: passed
• three independent reviews: approved

Hosted pull-request run 29291402007:

• Run npm ci --legacy-peer-deps --ignore-scripts: passed
• Run non-mutating frontend lint: passed
• Verify frontend lint left the checkout unchanged: passed
• complete frontend job, Functions, Firestore Rules, commerce journal, and artifact scrubber: passed
• Netlify deploy preview: passed; unchanged page/header subchecks skipped

Boundaries

Officer impact: None — this is an engineering quality gate and changes no officer task or public behavior.

Officer documentation: None — no officer procedure changes.

Deployment evidence: Source, local tests, hosted PR CI, and a disposable Netlify PR preview only. No production website publication, Firebase deployment, Stripe/provider change, branch-protection change, or production behavior is claimed. Post-merge hosted evidence remains pending.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	0bb1649
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a556cb552a638000820edc9
😎 Deploy Preview	https://deploy-preview-189--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.