fix(ci): define missing hosted-acceptance QA npm scripts (Gates 13, 16, 10–12)

[theonlygeranium]

Summary

Three hosted gate-acceptance workflows invoke npm run scripts that package.json never defined, so those workflows fail closed at their QA step. This defines the missing scripts, each pointing at its existing Vitest suite, matching the established qa:gate6-acceptance / qa:gate14-acceptance convention. Chosen as autonomous work that does not overlap the in-flight Gate 8 (Resend) effort.

Workflow	Script invoked	Now defined as	Gates
.github/workflows/shipcompliant-staging-acceptance.yml	qa:gate13-acceptance	vitest run tests/scripts/hosted-gate13-shipcompliant-acceptance.test.mjs	13
.github/workflows/gate16-custom-hostname-acceptance.yml	qa:gate16-acceptance	vitest run tests/scripts/hosted-gate16-custom-hostname-acceptance.test.mjs	16
.github/workflows/phase4-hosted-acceptance.yml	qa:phase4-hosted-acceptance	vitest run tests/scripts/hosted-phase4-acceptance.test.mjs	10, 11, 12

No workflow YAML changed (the references already existed); only package.json + CHANGELOG.md.

Why — these workflows would error on npm run <script> with "missing script", blocking the gate controllers from running their bundled QA in CI. The target test files already exist.

Deployment impact: CI / gate-controller wiring only. No application route, provider, database, credential, billing, DNS, or Worker activation change. All affected gates remain pending — this does not claim or advance any gate.

Coordination: Deliberately avoids the Gate 8 / Resend surface (scripts/hosted-gate8-acceptance.mjs, resend-*, config/resend-*, the ci.yml gate8 job). Gate 8's own QA (qa:resend-provisioning) is already defined, so there is no package.json overlap.

Type of change

• Bug fix (CI wiring)

Evidence level

• Local validation:
  • npm run qa:gate13-acceptance → 11 passed
  • npm run qa:gate16-acceptance → 13 passed
  • npm run qa:phase4-hosted-acceptance → 16 passed
  • package.json valid JSON
  • Classifier: node .github/scripts/delivery-policy.mjs --base origin/dev --head HEAD → lane operator-tooling-tested, risk medium (script keys match qa: and commands match vitest, accepted by operator-tooling-policy.mjs)

Classifier and test selection

• Candidate state: draft-not-candidate
• Risk: medium (operator-tooling-tested fast-lane)
• Surface: workflow
• Browser smoke / Frontend preview: policy-approved non-applicability

Logical delivery contract

• One consolidated [Unreleased] changelog entry
• Final merge to dev will squash to one logical Conventional Commit
• No ADR needed (routine CI defect repair; no architecture/policy change)
• No secret or private data in the diff

Environment and activation

Activation gates affected: None (wiring only; Gates 10–13 and 16 remain pending)

• No provider, billing, email, DNS, database, Worker, or gate is claimed active
• Neither human-review-required nor do-not-merge is present

Risks, rollback, and assumptions

Very low risk; adds three test-only npm scripts. Rollback = revert. Assumes the referenced Vitest suites remain the intended QA for those gates (verified present and green).

  

[cloudflare-workers-and-pages]

Deploying vinifera with    Cloudflare Pages

Latest commit:	ab47a47
Status:	✅  Deploy successful!
Preview URL:	https://34aa8418.vinifera.pages.dev
Branch Preview URL:	https://cursor-fix-hosted-gate-qa-sc.vinifera.pages.dev

View logs

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.