feat(activation): policy-hash generator for Gate 13 and Gate 16

[theonlygeranium]

Summary

Adds a small, safe, tested helper that removes the most error-prone manual step in the Gate 13 (ShipCompliant) and Gate 16 (custom hostname) activation runbooks: computing the exact SHA-256 *Sha256 policy entries the acceptance controllers fail-closed check. Chosen as autonomous, non-Gate-8 work per docs/activation/remaining-gates-manifest.md; it does not create provider resources, dispatch workflows, or change any gate status (13 and 16 remain pending).

New: scripts/gate-policy-hash.mjs (npm run ops:gate-policy-hash)

Subcommand	Input	Output
gate13	the workflow's SHIPCOMPLIANT_*, SUPABASE_URL, STAGING_WORKER_ORIGIN env values	paste-ready config/shipcompliant-staging-acceptance-policy.json object
gate16 --manifest <file>	the Gate 16 acceptance manifest JSON	paste-ready config/gate16-custom-hostname-acceptance-policy.json object
manifest-sha256 --manifest <file>	a manifest JSON	the byte hash for STAGING_GATE1{3,6}_ACCEPTANCE_MANIFEST_SHA256

Why it's correct and safe

• Reuses each controller's own sha256 + normalization, so generated hashes cannot drift from what the controller checks. The two pure Gate 13 normalizers (exactHttpsOrigin, exactApiPath) are now exported for reuse — a behavior-preserving change (controller suites still green).
• Read-only: prints only hashes (never the source secret values), makes no network calls, and mutates nothing.
• The Gate 16 test feeds the generated policy back into the controller's own authorize() and asserts it is accepted — a strong anti-drift cross-check.
• The Gate 13 and Gate 16 runbooks now reference the helper at their hashing steps (docs kept in sync).

Deployment impact: operator tooling + docs only. No application route, provider, database, credential, billing, DNS, Worker activation, or gate status change.

Type of change

• New feature (operator tooling)

Evidence level

• Local validation:
  • npx vitest run tests/scripts/gate-policy-hash.test.mjs → 5 passed (incl. the authorize() cross-check)
  • Gate 13 + Gate 16 controller suites → 24 passed (exports intact)
  • node --test .github/scripts/*.policy.mjs → 77 passed
  • npm test → 774 passed; 3 failures are the known cold-start 5s timeouts in tests/scripts/octopus-runbook.test.mjs (unrelated; pass warm — --testTimeout=60000 → 38/38)
  • CLI smoke: ops:gate-policy-hash gate13 emits a valid policy object
  • Classifier: --staged → lane high-risk, risk medium

Classifier and test selection

• Candidate state: draft-not-candidate
• Risk: medium (high-risk lane: touches a gate controller + package.json)
• Surface: mixed (scripts/tests/docs)
• Browser smoke / Frontend preview: policy-approved non-applicability

Logical delivery contract

• One consolidated [Unreleased] changelog entry
• Final merge to dev will squash to one logical Conventional Commit
• No ADR needed (tooling + docs; no architecture/security/policy boundary change)
• No secret or private data in the diff

Environment and activation

Activation gates affected: None (Gates 13 and 16 remain pending; this only eases populating their policies)

• No provider, billing, email, DNS, database, Worker, or gate is claimed active
• Deliberately avoids the Gate 8 / Resend surface
• Neither human-review-required nor do-not-merge is present

Risks, rollback, and assumptions

Low risk; adds one helper + one npm script + tests, exports two pure functions, and updates two runbooks. Rollback = revert. Assumes the two acceptance controllers remain the source of truth for normalization (reused directly, so they stay authoritative).

  

[cloudflare-workers-and-pages]

Deploying vinifera with    Cloudflare Pages

Latest commit:	28e2651
Status:	✅  Deploy successful!
Preview URL:	https://8ef2c216.vinifera.pages.dev
Branch Preview URL:	https://cursor-gate-activation-polic.vinifera.pages.dev

View logs

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.