Repair release integrity and complete Article Two evidence

[erinepshovel-code]

Purpose

Completes the repository-controlled portions of the next-best-step queue: establish deployment truth, close canon-integrity gaps, restore a real release gate, and turn Article Two's research scaffold into a reviewed evidence field.

What changed

• publishes _site/build.json with the exact site commit and canonical source identity
• verifies both the Pages deployment URL and interdependentway.org after deployment; stale or missing build identity fails the workflow
• repairs Markdown recovery heading parentage and preserves multiple superscript notes on one physical line
• stops tracking stale generated canon data and makes validation refresh first
• compares every Rights article's complete quoted excerpt and every parsed canon note against the selected canon
• adds Playwright route checks and automated serious/critical accessibility checks to PR and Pages release gates
• adds four reviewed Article Two sources and explicit support, dissent, and evidence-limit claims
• updates the home and recovery surfaces to reflect all eight vertical slices and the remaining Pages administration boundary
• declares new modules and runtime effects using current skill-lib MODULE_BUILD and BOUNDARIES field schemas, with usage and rollback guidance

File plan

Path	Change	Purpose	Risk	Required evidence
scripts/canon-parser.mjs, scripts/parse-canon.mjs	create/refactor	normalize recovery structure and split packed notes	canon route drift	parser fixtures + canon integrity
scripts/validate-content.mjs, scripts/verify-article-canon.mjs	strengthen/create	bind generated data and all eight article quotations to canon	false release failures on real drift	npm run validate
scripts/write-build-info.mjs, scripts/verify-live-deployment.mjs	create	make deployed commit identity observable	deployment remains red until platform settings are correct	generated artifact test + live workflow contact
playwright.config.mjs, scripts/serve-static.mjs, browser specs	create	test the generated public surface	existing accessibility defects may now block release	Playwright Chromium suite
workflows and package.json	modify	make all gates required in PR and Pages builds	longer CI; intended fail-closed behavior	workflow audit + full CI
Article Two and research ledgers	modify	replace empty research scaffold with reviewed support/dissent/limits	source interpretation overstated	provenance/reference tests + visible limitations
src/_data/generated/canon.json	delete/ignore	remove misleading stale checked-in authority	clean checkout must regenerate before use	prevalidate/pretest generation
docs/pages-release.md, README, home/fallback	modify/create	document usage, administration boundary, and recovery reading	none	content review

Verification performed before push

• JavaScript syntax checks for every added or modified .mjs file
• JSON and YAML parse checks
• node --test tests/canon-parser.test.mjs: 4 passing fixtures

A full npm ci/Eleventy/Playwright run could not be executed in the authoring container because it has no GitHub network access and no installed gh; the pull-request workflow is the authoritative full-contact run.

Platform boundary

Repository code cannot change Settings → Pages, DNS, custom-domain attachment, HTTPS, environment rules, or branch protection. docs/pages-release.md records the required values. A separate issue tracks those administrative actions.

hmmm

The code now refuses to call a stale public endpoint current. The release remains honestly incomplete until GitHub Pages is configured for Actions and the custom domain serves this PR's eventual main commit at /build.json.

[erinepshovel-code]

Verification update

Full GitHub contact is now green on head 2e5518967c94bfb799aef0892d03c6f67cf955ef:

• Build, validate, and test — passed
• Chromium installation — passed
• browser route checks — passed
• automated accessibility checks — passed
• CodeQL's six regex findings — fixed and automatically resolved
• CodeQL's filesystem race finding — replaced with file-descriptor use and automatically resolved
• PR mergeability — clean

The repository-controlled release work is ready. The remaining custom-domain/Pages administration boundary is tracked in issue #8 and will be tested by the post-deployment /build.json gate after merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e5518967c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check out the repo before verification

In the deploy job, this is the first step that references repository files, but that job never runs actions/checkout (the checkout only happens in the separate build job). Because GitHub Actions jobs run on fresh runners, there will be no scripts/verify-live-deployment.mjs on disk after actions/deploy-pages, so every otherwise-successful Pages deployment will fail here with a module-not-found error before the identity check can run.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Align the new exactness gate with current article text

With the current article sources, this new exact comparison makes npm run validate fail before Eleventy can build: the generated canon body preserves markers like [1] and has no marker on clean the mess, while src/articles/article-two.njk currently renders that same excerpt with superscripts and an extra ⁷. Because npm run check and both workflows now depend on this verifier, the release path is blocked unless the checked articles are made byte-for-byte equivalent under this normalization or the normalization accounts for the site's marker format.

Useful? React with 👍 / 👎.