rdmsm4x-changelog-20260825-1949-ak-final-hardening

Completed the bounded AK private-prototype hardening tranche so malformed browser-local data cannot blank the app or activate unsafe URLs, arbitrary submitted hosts cannot trigger Worker source fetches, streamed source bodies remain timeout-bound, and the combined accessibility gate passes.

Scope

• Host: rdmsm4x
• Project: private amagansett.app prototype estate
• Writer worktree: /Users/richh/dev/_handoff/codex-out/amagansett-white-preview-fidelity-20260825
• Branch: codex/amagansett-white-preview-fidelity-20260825
• Starting commit: d56f8ed8455c4a44b86a44a59aadd4f1c62886a6
• Source/test/config/types commit: ebc70e28d46dbaa1b82cd462ff411141fbc9ad88
• Report commit: e6145bbaf847bac3d3d3cadf97a1a20146d76c2c
• No deployment, credential use, Cloudflare Access change, public launch, provider signup, email send, or production-data mutation occurred.

Files changed

• package.json
• packages/ak-resolver/resolver.ts
• sites/ak/src/main.tsx
• sites/ak/src/site.css
• sites/ak/src/state.ts
• tests/e2e/ak-completion.spec.ts
• tests/integration/ak-wrangler-local-contract.zsh
• tests/unit/ak-resolver.test.ts
• tests/unit/ak-state.test.ts
• workers/amagansett-ak-edge/src/index.ts
• workers/amagansett-ak-edge/worker-configuration.d.ts
• .superpowers/sdd/2026-08-25-technical-completion/task-2-final-hardening.md

Material changes

• Added complete browser-local listing/candidate hydration guards, resolver-response validation, coordinate bounds, and a centralized public-HTTPS source helper used at rendered URL sinks.
• Limited automated source fetches to exact supported official-source hosts for Out East, Douglas Elliman, and Compass. Unsupported public HTTPS URLs remain truthful link-only Needs-source candidates; Zillow remains link-only.
• Extended AbortController coverage through robots and HTML body streaming, including reader cancellation/release on post-headers stalls.
• Added accessible MapLibre attribution underline, contrast, and focus treatment.
• Generated the production Worker environment declaration from deploy/ak.wrangler.jsonc; aligned the default module with ExportedHandler types. Production still exposes only ASSETS.
• Added regression tests for malformed/unsafe local storage, unsupported-host zero-fetch behavior, supported-host dependency injection, post-headers timeout cancellation, generated type drift, real local Worker behavior, and combined Axe cleanliness.

Verification commands and evidence

• npm test -- --run tests/unit/ak-state.test.ts tests/unit/ak-resolver.test.ts tests/unit/ak-edge.test.ts — 3 files, 34 tests passed.
• npm test — 8 files, 50 tests passed.
• npm run typecheck — strict TypeScript check passed.
• npm run build:ak — AK production build passed; known bundle-size warning remains.
• npx wrangler types workers/amagansett-ak-edge/worker-configuration.d.ts --config deploy/ak.wrangler.jsonc --include-runtime false --check — generated types current.
• npx wrangler deploy --dry-run --config deploy/ak.wrangler.jsonc — passed without deployment; only env.ASSETS listed.
• zsh tests/integration/ak-wrangler-local-contract.zsh — real local default-module API/static/scheduled contract passed.
• npx playwright test tests/e2e/ak-completion.spec.ts tests/e2e/prototypes.spec.ts --reporter=line — 12 tests passed, including serious/critical Axe gate.
• git diff --check — passed.
• Final writer worktree status — clean at e6145bbaf847bac3d3d3cadf97a1a20146d76c2c.

Backups and undo

• No file-copy backup was required because all project mutations are isolated and committed on the named branch/worktree.
• To undo without rewriting history, revert report commit e6145bbaf847bac3d3d3cadf97a1a20146d76c2c and source commit ebc70e28d46dbaa1b82cd462ff411141fbc9ad88 in that order.
• The canonical checkout /Users/richh/dev/sites/amagansett-app was not edited by this tranche.

Outstanding owner/lead actions

• Independent review/integration remains with the lead agent.
• Private deployment, rollback receipt, authenticated custom-domain verification, and unauthenticated Cloudflare Access denial probes remain separate release gates.
• Generic arbitrary-host automated extraction, durable D1 state, provider adapters, live scheduled acquisition history, and email delivery remain explicitly deferred.