Enforce WP00.02 Web project licence boundaries

[deku2026]

Change

Implement the accepted WP00.02 project licence profile (Design PR18, commit 6ba885ad38dd71de532c74d7b69f439d01d19a0a). Check the independently discovered Git inventory, explicit AGPL declarations in all three npm scopes and the IDE adapter, imported MSBuild overrides, confined project references and known first-party packages, including locked transitives and aliases. Windows CI evaluates the actual Debug/Release IDE properties and retains source/evaluated evidence. The candidate build enforces the same inventory.

Repair stale Cloud integration documentation after a real public browser check confirmed the already deployed same-origin service. No dependency versions, routes, permissions or public application behavior change.

Validation

• Pinned npm install and full npm run check: formatting, lint, strict typing and 21 unit tests.
• Actual MSBuild Debug/Release declarations and a rejected incorrect global property; actionlint 1.7.12 and whitespace checks.
• npm run build and npm run test:e2e: final candidate verified, 18 tests passed across Chromium, Firefox and WebKit.
• Current public browser observation: zero automatic API calls, one user-triggered POST 200 and expected real Cloud reply. This used the pre-change Web/Cloud deployments identified in docs; it does not prove the unmerged candidate has been deployed.
• Full local diff and new files reviewed; negative fixtures cover inventory drift, missing/inconsistent declarations, imported overrides, escaped references and unknown first-party dependencies.

Deployment

The existing pipeline must pass all applicable PR checks, then promote the exact merged candidate to Cloudflare and verify public assets/browser behavior. Those gates remain pending. The licence reports are policy evidence, not later commercial-product acceptance. Branch and worktree are retained.

[deku2026]

Reviewed and fixed the CodeQL finding: replacing a comment with whitespace cannot join surrounding fragments into new XML tokens. Added a real malformed-project regression fixture; full source checks pass (22 Web / 23 Cloud unit tests). No alert suppression or CI bypass. The final PR head must pass fresh CodeQL and all applicable checks before merge.

[deku2026]

Full PR review completed at 232a4d2; remote/local stable patch ID f83194bb83af92ab39c360fa84bd4b85cc58794d. Inventory coverage, effective IDE properties, reference boundaries, candidate integration, negative fixtures and factual Cloud documentation repair were reviewed. The comment-token CodeQL finding is fixed with regression coverage; fresh CodeQL is green. All applicable latest-head PR checks pass, including both source platforms and the three-browser candidate. No remaining findings. Main deployment, public byte verification and a real browser call remain pending post-merge.

[deku2026]

WP00.02 post-merge verification completed for 8d02a51. Main run 35401100500 passed all applicable checks, actual Cloudflare deployment and live three-browser verification. Both source-platform licence reports identify the clean merge commit; the Windows receipt also records the actual IDE properties.

Public release web-0.1.0-ci.19.1 targets the merge commit. Both assets were downloaded and match their GitHub SHA-256 digests; the unpacked release candidate passes the repository verifier and equals the exact CI candidate manifest/files. The deployment receipt confirms version/source/public URL and live-browser success.

An additional real public Chromium check loaded /cloud-hello/ with no automatic API call, clicked Check connection once, received one POST 200 and displayed Hello, ArcForges!. Public Web identity matched the merge and Cloud health reported Native AOT commit 2cf5a58633a7e09db05ebc1741f1cab83547a832. Receipt/screenshot: artifacts/evidence/wp00-02-postmerge.json and wp00-02-merged-live-browser.png in the retained worktree. Primary main is pulled; branch/worktree retained. This verifies the existing diagnostic boundary and policy change, not later commercial-product behavior.