npm run validate passes locally and in CI, including links, sitemap, public/noindex map, structure, assets, and risky copy scans.
Site QA gate
Do not publish until the site, claims, and release paths agree.
This noindex gate keeps The Gateway from shipping with broken metadata, unsupported claims, temporary contacts, or unclear privacy boundaries.
Homepage, public docs, and 404.html render on mobile and desktop without horizontal overflow or clipped controls.
The first public runbook, install and provision, opens and its safe commands block still renders.
Public pages appear in sitemap.xml; release gates stay noindex until external dependencies and evidence are real.
Copy says The Gateway can improve and verify privacy posture, not guarantee anonymity by itself.
Contact copy keeps credential custody, remote access, vulnerability reports, and intake separation explicit.
Contact templates do not request secrets, private keys, tokens, full traffic captures, or unredacted topology.
License, security contact, install evidence, rollback evidence, and hardware evidence are complete before broad repository promotion.
Next step after QA
Once the site checks pass, move straight to the production checklist so launch reviewers can confirm the public domain, proof artifacts, and operating surfaces before sending traffic live.