fix: certify generated symlink state

2026-07-31 19:20:39 -05:00
parent 7ae3f97789
commit df7530aeac
6 changed files with 269 additions and 29 deletions
@@ -207,6 +207,10 @@ pnpm install

 # Verify dependencies and generated state before running source-quality gates.
 # Missing dependencies exit 42; stale/foreign apps/web/.next state exits 43.
+# The web build certifies its exact standalone symlink manifest; added, removed,
+# retargeted, or manifest-only-tampered generated links also exit 43. This detects
+# accidental/independent drift, not a same-UID actor that can rewrite both records
+# consistently (CWE-345); an external trust anchor is required for that boundary.
 pnpm preflight

 # Optional local queue service only. This does not start PostgreSQL.