Vue 3 + Vuetify with Clerk and accepted M6 contracts revision 0.1.4, wire 0.1.1. Explore is the default hash route; /catalogue redirects to it. The current milestone wires Explore → area selection → Inspector → download. Process/Jobs, Shadow, Account and Case studies boards are paused by Mitch’s production-scope decision. No prices, server history, customers or product claims are invented.
Mitch’s exported twelve-board mockup is the visual authority. Side-by-side evidence is in docs/fidelity/index.html, with required differences and open fidelity work in DIFFERENCES.md. Functional completion is separate from visual acceptance.
The runtime always uses the real M6 API. There is no demo source, data flag or tier toggle. Empty API coverage shows “No buildings available in this area yet”. Test-only HTTP fixtures live under tests/fixtures and are never imported by application entries.
Use the pinned .external/ archives, unchanged. To regenerate them, make a scratch bare clone of the M6 repository (no checkout operations), set MITMON_M6_SOURCE to that scratch path, and run npm run bind:contracts then npm run bind:fs3. Both scripts read the recorded commits through git archive; they never reset or change a source checkout. FS3 361c681d supplies the reviewed horizontal scale correction and 0.1.4 dependency metadata; root pins/overrides retain one contracts/geo b707a0cf copy. Never edit shared @mitmon/* sources. Contract/FS3 digests are verified at startup, build and test; contract binding and FS3 binding record exact revisions.
source ~/.nvm/nvm.sh
nvm use
npm ci --ignore-scripts
node scripts/verify-contracts.mjs
node scripts/verify-fs3.mjs
VITE_DEV_PORT=5180 npm run dev -- --port 5180 --strictPort
Node 24.20.0 / npm 11.19.0. Ordinary worker server and smoke use 5180, strict port; Gate C mocked checks use 5183. 5173 belongs to Mitch; live Clerk/M6 tests require an orchestrator-provided window. Leave the UI worker’s 5182 gallery alone. Stop this worker’s manual server before smoke: reuseExistingServer=false always launches this checkout and fails on an occupied port.
npm test
VITE_API_ORIGIN=https://api.review.invalid npm run build
npm run lint
npm run test:smoke
npm run audit:artifact
npm run test:release
node apps/web/src/components/workspace/gallery/verify-production.mjs
The default smoke suite checks Ottawa start/reset, numeric/two-corner/drag rectangles, keyboard resize/navigation, test-only HTTP model 3D/anchor alignment, Inspector/detail gates, verified download, mobile overflow, real Clerk sign-in UI, basemap resources, inline-script/eval rejection, tile errors and delayed-open cancellation. The same API-only runtime checks honest signed-out coverage/allowance with no authenticated backend call. Human sign-in and account switch under A468 remain a separate required live test.
useWorkspaceSource always returns the API implementation. Synthetic API records and labelled test identities are rejected; no runtime demo code, flag or selector remains. Test-only mocked HTTP responses use accepted real contract shapes.api/transport.ts is the only auth transport. JSON responses use bound schemas. requestBytes shares fresh header-only tokens, complete-body deadlines, identity aborts and safe status-matching errors, with declared/streamed byte caps. DATA also verifies access purpose, artifact size/hash and preview complexity.preview:lod3 permits higher-detail preview; no current capability grants higher-detail export.VITE_GEOCODER=photon is an explicit optional build flag, off by default. Only flagged builds permit the exact Photon connection host and load the provider; address queries visibly disclose the external service.Build configuration validates an explicit release API origin and Clerk publishable-key input. Local dev/review may read the existing Development key file without logging/committing its value. The explicitly supplied api.review.invalid review-build placeholder is not deployable. A468 retains the observed CDN script source; A635’s proven rotating-ID fallback adds https://*.protect.clerk.com to script-src and https://*.protect.clerk.com:* to connect-src. No unsafe-eval, inline scripts or Cloudflare while captcha is off. Inline styles are the recorded exception. The dev websocket follows the actual server port; release omits it and emits an HTTP CSP header manifest with frame-ancestors ‘none’. CSP notes retain historical evidence and live-test status.
The backend route is the approved localhost:8787 forward. Do not start a live forward or use 5173 outside the coordinated window. Previous sign-in evidence is historical and does not prove the new policy’s live acceptance.
All delivery remains local-only: focused commits and one fresh secret-scanned review bundle for this production-scope round, no push/PR/deploy/scp. M-02 remains blocked on the accepted FS1 A459 isolated browser-build pipeline; this review-build/output audit is not isolation evidence. See release plan and georeferencing proof/limits. See integration handoff, product decisions and plan.
The A666 scale proof records the checker self-test, eight now-passing regressions and renderer/served-JS hashes. The real-GLB footprint adapter is still a separate follow-up.
The separate development-only official building placement checker uses /placement-check, the checksum-verified seven-building outline pack and actual rendered ground geometry. Its input files, projection dependency and TEST-only mocks are excluded from release output. Live placement verification requires a later coordinated window; this preparation does not run Gate C.
The FS1 Mac mapping preparation records immutable browser-file/import/dependency inputs for the next reviewed bundle. FS1 executes the actual isolated Mac build on M6 after target/public-version support, metadata and trusted configuration are approved. This local manifest is preparation only.