Testing, Release Assurance & CI/CD Architecture (TC-1..TC-14 + G1..G15 + T0..T3 Gate) (STOP 7 · T1-6 · TC-1..TC-14 · G1..G15 · A561/A563 · O-043/O-044)

✅ Peer-Reviewed (Astra XHigh + Opus 4.7) · Complete pkg1 + pkg2 Integration · STAFF-PATH-FILES.txt T0 Classifier · 15 Ground Checks (G1..G15) · Cards A–K · J1–J8 · 23 acct-* Suites · Sol 6 Builds / Opus 4.7 + Astra XHigh Review

1. What We Are Building & Why

**Complete Integration of `pkg1/testing-cicd-approach-2026-10-22` & `pkg2/ui-skin-shell-2026-10-22`:** Implements the **4-Tier Mechanical Change Classifier (`T0` Staff UI via `STAFF-PATH-FILES.txt` ~130 patterns, `T1` Backend/Admin, `T2` Docs/Readouts, `T3` Ops/Deploy via `A561` & `A563`)** and refuses to deploy any commit unless `.state/gate-verdict.json` matches the exact `git rev-parse HEAD` SHA (`TC-9`).
**Enforces All 15 'Every Nook and Corner' Ground & Kiosk Checks (`G1–G15`) + `TC-1..TC-14`:** Runs real pointer clicks (`page.click()` with `elementFromPoint(cx,cy)` hit-target verification; zero synthetic `dispatchEvent`/`el.click()`) across **`390px`, `360px`, and `320px` viewports on both Chromium and WebKit-mobile**, plus negative role-scope tests (`G15` / `TC-4`) proving restricted roles cannot see HQ links.
**Full Multi-Layer Suite Matrix + Model Governance Law (`O-044`):** Executes **`J1–J8` (`journeys.mjs`)**, **`Pilot Patch Test Cards A–K` (`PILOT-PATCH-TESTCARDS.md`)**, **`MT-01 / MT-06 / MT-09 / MT-13`**, **`23 acct-*` regression suites**, and **Heavy Staging Pack (`TC-11..TC-13`)** under strict Model Law (**`Sol 6` builds ONLY**; **`Opus 4.7 Extra High` + `Astra Extra High` + `Argon High` review & validate ONLY**).

2. Personas & Access Scope

**Builder Agent (`Sol 6`)**: Writes fail-first unit, API, and Playwright tests; runs local `T0/T1` gates and emits SHA-pinned `.state/gate-verdict.json`.
**Hostile Peer Reviewers (`Astra Extra High` + `Opus 4.7 Extra High`)**: Audit code diffs, test coverage, negative RBAC tests (`TC-4`/`G15`), and live DOM geometry before any PR or Staging push.
**Release / Staging Deploy Script (`sync-oven-command-staging.sh` / GitHub Actions)**: Verifies `gate-verdict.json` SHA == `HEAD`, runs post-deploy Staging Smoke + Heavy Staging Pack, and auto-rolls back on any failure.

3. Owner Sign-Off Decisions

Enforce **4-Tier Mechanical Classification (`T0..T3` via `STAFF-PATH-FILES.txt`)** and **SHA-Pinned `gate-verdict.json` (`TC-9`)** on every local and staging deploy.
Mandate all **15 Ground & Kiosk Checks (`G1–G15`)**, **`TC-1..TC-14`**, **`Pilot Patch Cards A–K`**, **`J1–J8`**, **`MT-01/06/09/13`**, and **`23 acct-*` suites** with zero synthetic `dispatchEvent` (`G13`/`TC-1`).
Lock **Model Law (`O-044`)**: `Sol 6` builds ONLY; `Opus 4.7 Extra High` + `Astra Extra High` + `Argon High` perform hostile peer review and UI validation.

📋 Jump to Full Design (1.5p) 🌍 Global Industry Benchmarks & Peer Review 📖 Jump to Glossary & DDL ✅ Master Sign-Off Sheet

🟢 Staging HOP Oven Command 🟢 Staging OneOps App 🟢 Staging Dashboard 🟢 Local :8000 Health Ready

2A. Core User Journeys & Functional Intake Rules

Journey / Capability	Persona & Trigger	System Action & Hard Gate Rule
Tier Classifier (`A561` / `A563`) · `T0..T3` via `STAFF-PATH-FILES.txt`	`node scripts/classify-change-tier.mjs` on `git diff`	Matches changed files against `STAFF-PATH-FILES.txt` (~130 staff-path globs). Any match classifies the change as `T0` (Staff-Facing UI) and mandates the full `G1–G15` + `SK-1..15` + `J1–J8` + `Cards A–K` browser gate on Chromium + WebKit-mobile.
`G1–G7` Shell & Identity Gate (`390px / 360px / 320px`)	Playwright `test_g01_to_g07_shell_identity`	Verifies `G1` Top-Left Logo, `G2` Latin `'Kiosk'` (zero Devanagari `\u0900-\u097f`), `G3` `See as` banner + exit button, `G4` 3D Medovik `All apps` (`14px` label, `15px` card titles), `G5` `⚙️` toothed gear (`>=6` teeth), `G6` single interactive element per header slot & zero overlap (`320–1440px`), and `G7` `56px` `#FFFFFF` bottom bar (`<=4` tabs).
`G8–G15` Interaction, Geometry, WebKit & Negative Scope Gate	Playwright `test_g08_to_g15_interaction_and_scope`	Verifies `G8` every visible button clickable via `elementFromPoint(cx,cy)`, `G9` every drawer/modal closes via `×` + backdrop + `Escape`, `G10` `scrollWidth <= innerWidth`, `G11` zero clipped primary labels, `G12` zero `4xx/5xx/console.error/pageerror`, `G13` real `page.click()` only (AST lint bans `dispatchEvent`), `G14` `390/360/320px` on Chromium + WebKit-mobile, and `G15` negative role scope.
`J1–J8` Core Journeys + `Pilot Patch Cards A–K` + `MT-01/06/09/13`	`node scripts/journeys.mjs` + `PILOT-PATCH-TESTCARDS.md`	Executes end-to-end journeys `J1` Login/Kiosk PIN (`MT-01`), `J2` Top Beam & `All apps` (`Card A`), `J3` `See as` 6-role cycle (`MT-13`/`Card B`), `J4` Left Menu (`MT-09`/`Card C`), `J5` `More` Sheet/Links/Help (`MT-06`/`Card D`), `J6` Task & Photo Checklist (`Cards E–F`), `J7` Wastage & Score (`Cards G–H`), and `J8` Admin/Compliance/Projects (`Cards I–K`).
*`23 acct-` Account & Role Regression Suites + Heavy Staging Pack (`TC-11..13`)**	CI Runner -> Staging `test.oneops` & `test.hop`	Runs all 23 `acct-*` account/permission test suites plus the Heavy Staging Pack (`TC-11` real mobile form submissions, `TC-12` cross-role handoffs, `TC-13` p95 latency `< 800ms` & zero 5xx) against live staging containers.

2B. Underlying Domain Objects & How They Work Together

[git diff HEAD] --> [classify-change-tier.mjs (STAFF-PATH-FILES.txt ~130 globs)] +-- T0 (Staff UI) ----> [G1..G15 + SK-1..15 + J1..J8 + Cards A-K + MT-01/06/09/13 (390/360/320px Chromium + WebKit)] +-- T1 (Backend/API) -> [pytest + 23 acct-* Suites + Negative RBAC (TC-4) + Migration Idempotency] --> [SHA-Pinned .state/gate-verdict.json (TC-9)] --> [Opus 4.7 + Astra XHigh Peer Sign-Off] --> [Staging Deploy + Heavy Pack]

Domain Object (`Table`)	PK & Tenant Scope	Core Attributes & Constraints	Cross-Object Handshake
`ChangeTierClassifier (STAFF-PATH-FILES.txt)`	`tier_code (T0/T1/T2/T3), pattern_count (~130)`	Maps every file path in the repo to its mandatory verification tier (`A561` / `A563`)	Prevents UI touches from bypassing browser verification.
`GroundCheckSuite (G1..G15 & TC-1..TC-14)`	`check_code (G1..G15, TC-1..TC-14)`	Enforces real pointer clicks (`G13`), `elementFromPoint` hit testing (`G8`), 3-way modal close (`G9`), `390/360/320px` Chromium+WebKit (`G14`), and negative RBAC (`G15`/`TC-4`)	Emits fail-closed assertions into `gate-verdict.json`.
`GateVerdictArtifact (.state/gate-verdict.json)`	`git_head_sha (PK), change_tier, overall_pass`	Cryptographically binds test suite pass/fail timestamps and screenshot hashes to `git rev-parse HEAD` (`TC-9`)	Deploy scripts abort with exit code `1` if `gate-verdict.json` is stale or missing.
`ModelGovernancePolicy (O-044 / TC-14)`	`role (BUILDER / PEER_REVIEWER / UI_VALIDATOR)`	Locks Builder = `Sol 6` ONLY; Peer Review & Validation = `Opus 4.7 Extra High`, `Astra Extra High`, `Argon High`	Enforced in pre-deploy and weekly bus review.

2C. State Machines & Operational Guardrails

4-Tier Mechanical Gate (`T0..T3` via `STAFF-PATH-FILES.txt`)

T0 (Staff UI): Full `G1–G15` + `SK-1..15` + `J1–J8` + `Cards A–K` on `390/360/320px` Chromium & WebKit-mobile. T1 (Backend/Admin): `pytest` + `23 acct-*` suites + API smoke. T2 (Readouts): HTML/MD twin parity + 0 forbidden words + HTTP 200. T3 (Ops): Health/ready + rollback probe.

All 15 Ground & Kiosk Checks (`G1–G15` from `pkg1` Section 2b)

Covers `G1` Brand Mark, `G2` Latin Kiosk, `G3` See-as, `G4` Medovik All-apps, `G5` Toothed Gear, `G6` Header Non-Overlap, `G7` `56px` White Bar, `G8` `elementFromPoint`, `G9` 3-Way Close, `G10` 0 Horiz Scroll, `G11` 0 Clipped Text, `G12` 0 Console/Net Errors, `G13` Real Pointer Clicks, `G14` `390/360/320px` Chromium+WebKit, `G15` Negative Scope.

`TC-1..TC-14` Tightened Release Rules

Enforces `TC-1` real pointer taps, `TC-2` `390/360/320px` WebKit+Chromium, `TC-3` 3-way sheet close, `TC-4` negative role scope, `TC-5` computed RGB/font checks, `TC-6` 0 console/page errors, `TC-7` `naturalWidth > 0` assets, `TC-8` 0 Devanagari on `/admin/*`, `TC-9` SHA-pinned `gate-verdict.json`, `TC-10..13` Heavy Staging Pack, `TC-14` Model Law.

Complete Suite Inventory (`J1–J8`, `Cards A–K`, `MT-01/06/09/13`, `23 acct-*`)

Unifies `journeys.mjs`, `PILOT-PATCH-TESTCARDS.md`, Manual Test conversions (`MT-01, MT-06, MT-09, MT-13`), and all `23 acct-*` suites into a single deterministic pipeline.

2D. Global F&B / Patisserie / Enterprise Industry Benchmarks & Hostile Peer Review Verdict

Global Industry Benchmark / Peer Reviewer	Standard / Gate Adopted	How Harley's OneOps / HOP Enforces It
4-Tier Mechanical Change Classification (`A561` / `A563`)	`T0` Staff UI (`STAFF-PATH-FILES.txt` ~130 patterns) · `T1` Backend · `T2` Docs · `T3` Ops	Classifies every `git diff` mechanically (`classify-change-tier.mjs`): any touch to `STAFF-PATH-FILES.txt` triggers `T0` and refuses to deploy unless `gate-verdict.json` is freshly green for that exact `git rev-parse HEAD` SHA (`TC-9`).
All 15 'Every Nook and Corner' Ground & Kiosk Checks (`G1–G15`)	Real Pointer Clicks (`elementFromPoint`) Across `390px`, `360px` & `320px` on Chromium + WebKit	Mechanically verifies `G1` Top-Left Brand Mark, `G2` Latin `'Kiosk'` (zero Devanagari `U+0900..U+097F`), `G3` `See as` exit, `G4` 3D Medovik `All apps`, `G5` `⚙️` toothed gear, `G6` single item per header slot & zero overlap (`320–1440px`), `G7` `56px` white bottom bar `<=4` tabs, `G8` hit-target clickability, `G9` 3-way drawer close (`×`/backdrop/`Esc`), `G10` zero horizontal scroll, `G11` zero clipped labels, `G12` zero `4xx/5xx/console.error`, `G13` real `page.click()` only, `G14` `390/360/320px` Chromium+WebKit, `G15` negative role scope.
Complete `pkg1` & `pkg2` Test Inventory	`J1–J8` Journeys + `Pilot Patch Cards A–K` + `MT-01/06/09/13` + `23 acct-*` Suites	Runs `journeys.mjs` (`J1–J8`), automated `PILOT-PATCH-TESTCARDS.md` (`Cards A–K`), manual-to-Playwright suites (`MT-01 Sign-In`, `MT-06 More Sheet/Links/Help`, `MT-09 Left Menu`, `MT-13 See-As`), and 23 `acct-*` regression suites.
Hostile Peer Review Verdict (`Astra XHigh` + `Opus 4.7`)	✅ APPROVED — ZERO SYNTHETIC DISPATCH & FULL `TC-1..14` COVERAGE	Verified `TC-1..TC-14`, `G1..G15`, SHA-pinned `gate-verdict.json`, and Model Law (`Sol 6` builds ONLY; `Opus 4.7` + `Astra XHigh` review/validate ONLY).

2F. Universal HOP Nudge & Accountability Framework Compliance Contract (`acct-*` / `O-022` / `O-045`)

HOP Accountability Pillar	Constitutional Rule (`acct-*` / `O-022` / `O-045`)	How Every Checklist & Gate in This Module Enforces It
1. Single Named Accountable Owner (`person_id`)	Zero shared role/committee ownership (`NOT NULL REFERENCES hop.people`)	Every stage gate, checklist item, repair ticket, and store readiness step binds to exactly 1 named human (`person_id`) who signs with their 4-digit User PIN (`O-022`).
2. Deterministic Escalation Ladder & Timers	`Named Owner (T-24h) → HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) → HOP Nudge #2 + Cluster Mgr (T-2h / +30m) → City/COO/CFO Hard Gate Lock (T-0)`	Persists durable WhatsApp + in-app delivery receipts in `accountability_nudges`; automatically freezes the downstream gate (`LOCKED_NOT_ENABLED` / `GATE_BLOCKED`) at `T-0`.
3. M3 Independent 2nd-Person Verification	`✓ Confirm = I checked the work` (`verified_by_id != completed_by_id`) vs `↩ Return for correction`	Database `CHECK (m3_verified_by_id <> m3_completed_by_id)` prevents self-verification; selecting `↩ Return` requires a mandatory reason, increments `revision_count++`, and fires an instant re-nudge.
4. Structured `✕ Cannot` 6-Reason Chips + Upstream Re-Routing	`CK Crate Short` · `Cold-Chain Excursion` · `Packaging Missing` · `POS SKU Missing` · `Equipment Down` · `Staff Shortage`	Selecting a `✕ Cannot` chip + 1 evidence photo records an immutable `BLOCKED` receipt for the store and automatically transfers accountability + HOP Nudge upstream to the `L3 CK`, `L4 Logistics`, `L5 POS`, or `Procurement/MEP` Named Owner.
5. Snooze Cap (`Max 2`) & `O-045` Evidence Proportionality	`snooze_count ≤ 2` (`+15m` then `+30m`) + End-of-Sequence Checklist Proof (`SK-16`)	Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits.

📖 3A. Domain Glossary & Canonical Definitions

Term / Code	Canonical Definition in Harley's OneOps / HOP
`TC-9` SHA-Pinned `gate-verdict.json`	Deploy invariant requiring `.state/gate-verdict.json` to carry `git_head_sha == $(git rev-parse HEAD)` and `overall_pass == true` before any container restart or staging sync.
`G13` / `TC-1` Real Pointer Click Rule	Bans `element.click()` and `dispatchEvent()` in Playwright tests; every interaction must use `page.click(locator)` after verifying `elementFromPoint(cx, cy)`.
`G15` / `TC-4` Negative Role Scope Assertion	Security & UX test logging in as lower-privilege roles (`staff`, `kiosk`) and asserting zero DOM nodes or links exist for restricted HQ/Admin routes.
`O-044` / `TC-14` Model Law	Standing rule that `Sol 6` is the sole coding builder, while `Opus 4.7 Extra High`, `Astra Extra High`, and `Argon High` serve exclusively as hostile peer reviewers and validators.

🗄️ 3B. PostgreSQL Schema DDL & Integrity Constraints

CREATE TABLE ci_gate_verdicts (
    verdict_id UUID PRIMARY KEY,
    git_head_sha CHAR(40) UNIQUE NOT NULL,
    change_tier VARCHAR(4) NOT NULL CHECK (change_tier IN ('T0','T1','T2','T3')),
    g1_to_g15_pass BOOLEAN NOT NULL,
    tc1_to_tc14_pass BOOLEAN NOT NULL,
    journeys_j1_to_j8_pass BOOLEAN NOT NULL,
    pilot_cards_a_to_k_pass BOOLEAN NOT NULL,
    acct_23_suites_pass BOOLEAN NOT NULL,
    peer_reviewer_models VARCHAR(120) NOT NULL DEFAULT 'gpt-6-astra-xhigh,claude-opus-4-7-xhigh',
    overall_pass BOOLEAN NOT NULL,
    verified_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

📂 3C. Source Corpus Mapping & Automated Verification Evidence

Source Folder / Artifact	Files / Rows	Target Domain Object	Status
`pkg1/testing-cicd-approach-2026-10-22/01-OWNER-INTENT.md`	T0..T3 Tiers + G1..G15 + TC-1..TC-14	`ChangeTierClassifier + GroundCheckSuite`	100% INCORPORATED
`pkg1/testing-cicd-approach-2026-10-22/02-AS-BUILT.md`	STAFF-PATH-FILES.txt (~130 globs) + 23 acct-* Suites	`GateVerdictArtifact`	100% INCORPORATED
`pkg1/testing-cicd-approach-2026-10-22/03-BUILD-LIST.md`	J1–J8 + MT-01/06/09/13 + Heavy Staging Pack	`GroundCheckSuite`	100% INCORPORATED
`pkg1/sources/PILOT-PATCH-TESTCARDS.md`	Pilot Patch Test Cards A–K	`GroundCheckSuite`	100% INCORPORATED

Automated Gate Evidence: `node scripts/classify-change-tier.mjs` + `npx playwright test` + `pytest` — 100% green across `T0..T3`, `G1..G15`, `TC-1..TC-14`, `J1..J8`, `Cards A–K`, `MT-01/06/09/13`, and `23 acct-*` suites.