# Site QA Gate

Use this before moving The Gateway from pre-launch preview to a public production domain.

## Required Checks

- `npm run validate` passes locally and in CI.
- Homepage, public docs, and `404.html` render on mobile and desktop without horizontal overflow.
- Public pages in `sitemap.xml` are accurate and do not carry `noindex`.
- Release gates stay `noindex` until their dependencies are real.
- Canonical URLs, robots, Open Graph image, favicon, and sitemap point to the production domain.
- Mailto templates do not request secrets, private keys, tokens, full traffic captures, or unredacted topology.
- Contact, support, sponsor, appliance, and MSP paths disclose privacy expectations.
- Contact privacy copy keeps credential custody, remote access, vulnerability reports, and intake separation explicit.
- Copy says The Gateway can improve and verify privacy posture, not guarantee anonymity by itself.
- Internal assistant or development terms are absent from public product copy.
- License selection, security contact, install evidence, rollback evidence, and hardware evidence are complete before broad repository promotion.

## Browser Smoke Test

- Homepage hero loads the bitmap asset.
- Navigation links reach their target sections, including pre-launch status and public readiness.
- Public launch status page separates ready-to-review, gated, and proof-needed surfaces.
- Deployment mode tabs switch content.
- CTA buttons resolve to public docs or contact templates.
- Launch dependency roadmap renders its gate order.
- Evidence checklist renders claim-to-proof ledger and evidence hygiene boundaries.
- Production checklist renders go/no-go gates and launch role ownership.
- The first public runbook, `runbooks/install-and-provision.html`, opens and its safe commands block still renders.
- Mobile viewport keeps headings, buttons, and cards inside their containers.
- 404 page returns a usable path back to the homepage.

## Autonomous Improvement Cycle Log

2026-05-29 known-limitations launch-status navigation cycle batch:

- Cycle 41: Add a direct launch-status CTA from the known limitations page so readers can move from the limitations list to the public launch overview without detouring through the homepage or docs map.
  - Done: added `Open launch status` to the known limitations next-action block and covered it in browser smoke.

2026-05-29 public-site cycle batch:

- Cycle 1: Keep the public name as The Gateway across homepage metadata, docs, and QA wording.
- Cycle 2: Add visible pre-launch status so visitors know what is ready to review and what remains gated.
- Cycle 3: Keep self-service install claims conservative until fresh-machine, rollback, and hardware evidence exists.
- Cycle 4: Add homepage copy that ties privacy claims to route traces, DNS traces, leak checks, fallback behavior, and evidence.
- Cycle 5: Add an operator handoff flow so support starts from current state and redacted proof instead of blind access.
- Cycle 6: Keep route ownership, DNS ownership, fallback ownership, and final apply approval explicit in public CTAs.
- Cycle 7: Preserve public support boundaries around credentials, traffic paths, rollback, and remote access.
- Cycle 8: Add mobile layout rules for the new status and handoff blocks.
- Cycle 9: Re-run static validation after the copy and structure changes.
- Cycle 10: Re-run browser smoke checks and capture fresh homepage screenshots before reporting.

2026-05-29 public-readiness cycle batch:

- Cycle 1: Add a homepage public-readiness section that separates visible trust story, endpoint wiring, install proof, and unsupported broad claims.
- Cycle 2: Link the homepage readiness block to launch dependency, repository readiness, and production checklist gates.
- Cycle 3: Expand the launch dependency roadmap with an explicit gate order: contact surface, repository surface, evidence surface, operations surface.
- Cycle 4: Extend copy validation to block the old project name in public files.
- Cycle 5: Extend copy validation to block public mentions of unsafe/internal terms such as public tunnel names and internal assistant system names.
- Cycle 6: Update GitHub issue and PR templates to use The Gateway naming.
- Cycle 7: Scope copy validation away from local agent workspace files so public checks focus on website/repository artifacts.
- Cycle 8: Expand smoke tests so the public readiness block is covered on desktop and mobile.
- Cycle 9: Add a smoke test for the launch dependency roadmap and its gate order.
- Cycle 10: Re-run static validation, browser smoke checks, and high-severity dependency audit after the changes.

2026-05-29 documentation-map cycle batch:

- Cycle 17: Make the browser-readable documentation map action-oriented so reviewers can jump from the map to site QA and the release checklist without hunting for the next gate.
  - Done: added site QA and release checklist CTAs to the documentation map next-action block and covered them in browser smoke.

2026-05-29 evidence-and-recovery cycle batch:

- Cycle 1: Expand the public evidence checklist from a short proof list into a claim-to-proof ledger.
- Cycle 2: Add install-claim evidence requirements: fresh-machine transcript, hardware profile, dependencies, failure points, and rollback note.
- Cycle 3: Add route and DNS ownership evidence requirements so launch claims map to concrete traces.
- Cycle 4: Add privacy posture evidence requirements with explicit browser, account, transport, and non-anonymity boundaries.
- Cycle 5: Add recovery and support evidence requirements covering rollback, backup restore, recovery access, redaction, and credential custody.
- Cycle 6: Add evidence hygiene boundaries: what can be published, what stays private, and what must be marked uncertain.
- Cycle 7: Add production go/no-go gates to block launch on placeholder endpoints, unsupported claims, missing rollback, or vague credential custody.
- Cycle 8: Add launch roles for website, repository, evidence, and support ownership.
- Cycle 9: Improve the 404 page with stable recovery links to install readiness, support boundaries, evidence, and launch gates.
- Cycle 10: Expand browser smoke tests to cover evidence ledger, production gates, and 404 recovery links.

2026-05-29 evidence-accessibility cycle batch:

- Cycle 11: Make the redaction guide easier to find from the homepage and evidence checklist so public proof sharing stays redaction-first.
  - Done: added a homepage redaction link in the launch strip and an evidence-page reminder to review redaction before attaching logs or screenshots.
- Cycle 12: Make the redaction guide easy to find from contact privacy so intake starts redaction-first.
  - Done: added a contact privacy retention note and a direct redaction guide button before support intake.
- Cycle 13: Make the noindex release gates in the documentation map directly clickable so local reviewers can jump to the right gate without hunting through filenames.
  - Done: linked the noindex gate list in the browser docs map and the markdown doc map.
- Cycle 14: Add browser smoke coverage for the first public runbook so the safe commands block is exercised in local checks.
  - Done: added a Playwright check for `docs/runbooks/install-and-provision.html` and its safe commands section.

2026-05-29 QA-navigation cycle batch:

- Cycle 15: Make the production checklist point directly to the site QA gate and documentation map so launch reviewers can jump from go/no-go decisions to the validation criteria.
  - Done: added `site-qa.html` and `README.html` links to the production checklist next-action block, and covered them in browser smoke.

2026-05-29 docs-map cycle batch:

- Cycle 16: Make the browser-readable documentation map link maintainer templates so local reviewers can jump to template sources without hunting the repo.
- Cycle 18: Make the browser-readable documentation map point directly to repository readiness so launch reviewers can move from the doc map to the repo gate without detouring through unrelated pages.
  - Done: added a repository readiness CTA to the HTML and markdown documentation map and covered it in browser smoke.

2026-05-29 homepage-QA navigation cycle batch:

- Cycle 19: Add a direct site QA CTA from the homepage public-readiness block so launch reviewers can jump from the public story to the gate without detouring through the documentation map.
  - Done: added an `Open site QA gate` button to the homepage readiness actions and covered it in browser smoke.

2026-05-29 repository-QA navigation cycle batch:

- Cycle 20: Add a direct site QA CTA from the repository readiness gate so launch reviewers can move from repo launch prerequisites to publication checks without detouring through the docs map.
  - Done: added an `Open site QA gate` button to the repository readiness next-action block and covered it in browser smoke.

2026-05-29 release-checklist navigation cycle batch:

- Cycle 21: Add direct install-readiness and site-QA CTAs from the release checklist so reviewers can move from release gates to the next operational checks without detouring through the docs map.
  - Done: added `Request install readiness review` and `Open site QA gate` buttons to the release checklist next-action block and covered them in browser smoke.

2026-05-29 site-QA support navigation cycle batch:

- Cycle 22: Add direct support-boundary and redaction-review CTAs from the site QA gate so publication review can jump straight from release decisions to the support/privacy docs.
  - Done: added `Review support boundaries` and `Review redaction guide` buttons to the site QA next-action block and covered them in browser smoke.

2026-05-29 site-QA production navigation cycle batch:

- Cycle 23: Add a direct production checklist CTA from the site QA gate so publication review can move from site validation to launch confirmation without detouring through the docs map.
  - Done: added `Open production checklist` to the site QA next-action block and covered it in browser smoke.

2026-05-29 launch-dependencies navigation cycle batch:

- Cycle 24: Add direct sponsor, support intake, and evidence CTAs from the launch dependency roadmap so reviewers can jump from temporary endpoints to the relevant public gates without detouring through the launch plan.
  - Done: added `Open sponsor page`, `Open support intake`, and `Open evidence checklist` buttons to the launch dependency next-action block and covered them in browser smoke.

2026-05-29 install-readiness navigation cycle batch:

- Cycle 25: Add direct site QA and evidence CTAs from the install readiness gate so reviewers can move from install evaluation to publication checks and proof collection without detouring through the docs map.
  - Done: added `Open site QA gate` and `Open evidence checklist` buttons to the install readiness next-action block and covered them in browser smoke.

2026-05-29 public launch-status cycle batch:

- Cycle 26: Add a public launch status page so visitors can review status without opening noindex maintainer gates.
- Cycle 27: Make launch status distinguish ready-to-review items, useful next action, still-gated items, missing proof, non-anonymity boundaries, and support boundaries.
- Cycle 28: Add status-by-surface copy for public site, repository, and operations readiness.
- Cycle 29: Link launch status to install readiness, evidence, support boundaries, and known limitations.
- Cycle 30: Promote launch status from the homepage public-readiness actions before noindex maintainer gates.
- Cycle 31: Add launch status to the public documentation map.
- Cycle 32: Add launch status to `sitemap.xml` as a public page.
- Cycle 33: Update the 404 recovery paths to point users to launch status instead of maintainer-only dependency gates.
- Cycle 34: Add browser smoke coverage for the public launch status page and the homepage launch-status CTA.
- Cycle 35: Re-run public map validation, sitemap validation, browser smoke, and high-severity dependency audit after adding the page.

2026-05-29 site-QA launch-status navigation cycle batch:

- Cycle 36: Add a direct launch-status CTA from the site QA gate so reviewers can move from publication validation to the public status page without detouring through the homepage.
  - Done: added `Open launch status` to the site QA next-action block and covered it in browser smoke.

2026-05-29 production-checklist repository navigation cycle batch:

- Cycle 37: Add a direct repository-readiness CTA from the production checklist so launch reviewers can jump back to the repo launch gate without detouring through the docs map.
  - Done: added `Open repository readiness` to the production checklist next-action block and covered it in browser smoke.

2026-05-29 repository-readiness support-boundaries cycle batch:

- Cycle 38: Add a direct support-boundaries CTA from repository readiness so repo launch review can jump straight to the support policy gate without detouring through the docs map.
  - Done: added `Review support boundaries` to the repository readiness next-action block and covered it in browser smoke.

2026-05-29 contact-privacy support-boundaries cycle batch:

- Cycle 39: Add a direct support-boundaries CTA from contact privacy so support intake review can move from redaction and intake rules to the full support policy without detouring through the docs map.
  - Done: added `Review support boundaries` to the contact privacy next-action block and covered it in browser smoke.

2026-05-29 documentation-map privacy-posture cycle batch:

- Cycle 40: Add a direct privacy-posture CTA from the documentation map so reviewers can jump from the docs index to route, DNS, fallback, and leak verification without detouring through the page list.
  - Done: added `Open privacy posture checklist` to the documentation map next-action block, mirrored the guidance in the markdown map, and covered it in browser smoke.

2026-05-29 sponsor-support-boundaries cycle batch:

- Cycle 41: Add a direct support-boundaries CTA from the sponsor page so funding and operational-help paths stay separate for visitors.
  - Done: added `Review support boundaries` to the sponsor page next-action block and covered it in browser smoke.

2026-05-29 support-boundaries launch-status cycle batch:

- Cycle 42: Add a direct launch-status CTA from the support boundaries page so visitors can move from support policy to the public status page without detouring through the homepage or docs map.
  - Done: added `Open launch status` to the support boundaries cross-check and next-action block, mirrored it in markdown, and covered it in browser smoke.

2026-05-29 documentation-map maintainer-templates cycle batch:

- Cycle 43: Add direct repository maintainer template links from the documentation map so reviewers can jump to contribution, security, support, and issue/PR template files without hunting the repo root.
  - Done: added `CONTRIBUTING.md`, `SECURITY.md`, `SUPPORT.md`, pull request template, and issue template config links to the browser-readable and markdown documentation maps, and covered the new paths in browser smoke.

2026-05-29 known-limitations install-readiness navigation cycle batch:

- Cycle 44: Add a direct install-readiness CTA from the known limitations page so visitors can move from the limitations list straight into the first release gate review.
  - Done: added `Request install readiness review` to the known limitations next-action block, mirrored the guidance in markdown, and covered the new CTA in browser smoke.

2026-05-29 launch-status privacy-posture navigation cycle batch:

- Cycle 45: Add a direct privacy posture CTA from the launch status page so visitors can move from the public status summary to the posture checklist without detouring through the docs map.
  - Done: added `Open privacy posture checklist` to the launch status next-action block and covered it in browser smoke.

## Release Decision

Do not ship if any public claim depends on private evidence, temporary contacts, missing license decisions, unsupported hardware, or untested rollback behavior.