Bootstrap Web with React and verified Cloudflare delivery

[deku2026]

Change

The repository previously contained only its license. Add a prerendered React 19.3 / TypeScript 7.0.2 Hello site and a local greeting using the published Contracts packages (1.0.0-ci.25.1), with shared UI and an optional Visual Studio solution.

Establish exact dependencies and a root lockfile, worktree-local hooks, Git/editor policy, contributor/security guidance, third-party notices, Dependabot, secret scanning and CodeQL for TypeScript/Actions. Preserve the existing AGPL-3.0-only license. Main requires both Verify and the CodeQL security result before merge; CSP hashes use an HTML parser, and Windows validation avoids the optional cache-archiving step that stalled on the hosted runner.

CI checks Windows/Linux source, builds one candidate, and tests those production assets in Chromium, Firefox and WebKit. Main pushes promote the same hashed artifact to Workers Static Assets, verify its public bytes, and create an automatically versioned prerelease. Missing deployment credentials fail explicitly. PRs never use Cloudflare secrets.

Validation

Hosted CI passed on the final head: https://github.com/ArcForges/Web/actions/runs/35028613153. Both Windows/Linux source checks, dependency audit/review, history secret scan, CodeQL analyses and the separate CodeQL security result, candidate build, all three browsers and final artifact verification passed.

• Exact dependency installation, policy, formatting, Biome, strict TypeScript: passed locally.
• 8 unit/component/published SDK wire-fixture/delivery tests: passed.
• 12 browser cases across Chromium, Firefox and WebKit against local Wrangler: passed, including WCAG checks, narrow layout, no-JavaScript behavior, keyboard interaction, CSP/cache headers and genuine 404s.
• Production candidate hashes verified before and after browser testing; Wrangler deployment dry-run passed without changing the artifact.
• npm audit: zero known vulnerabilities. SHA-verified actionlint 1.7.12: passed.
• Desktop/mobile screenshots inspected. Optional solution accepted by MSBuild with workload resolution disabled; interactive Visual Studio startup is not claimed.

Deployment and limits

The owner explicitly deferred deployment credentials. The main-only GitHub cloudflare environment and CLOUDFLARE_ACCOUNT_ID variable exist; CLOUDFLARE_API_TOKEN is still absent. Configure that environment secret when ready; merging without it will make the deployment job fail clearly. No live Cloudflare deployment, real C# integration, authentication or commercial product behavior is claimed.

See docs/deploying.md for setup, automatic versioning and recovery, and docs/bootstrap-plan.md / docs/validation.md for scope and evidence. The primary checkout and adjacent repositories are unchanged.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.