chore: document and harden Console CI

.github/pull_request_template.md

@@ -0,0 +1,44 @@
+## Summary
+
+<!-- Describe the Console behavior changed and why it belongs in this repository. -->
+
+## Compatibility and cross-repository impact
+
+- Gateway/Core contract revision:
+- Affected routes or public types:
+- NeKiro-Stack manifest or browser acceptance update:
+
+- [ ] No public contract or route semantics changed.
+- [ ] Any compatible contract change is documented and tested.
+- [ ] Any breaking change has an explicit migration decision.
+
+## Verification
+
+Commands run:
+
+```text
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+Observed success signals:
+
+<!-- Record passing test counts, successful build output, and Stack browser evidence when applicable. -->
+
+## Security and failure semantics
+
+- [ ] Credentials are not logged, persisted in browser storage, or committed.
+- [ ] Missing, invalid, unauthorized, and dependency-failure states remain distinct.
+- [ ] No retry, alternate endpoint, mock success, or silent degradation was introduced without policy evidence.
+
+Fallback delta: removed 0, retained 0, added 0, net 0
+
+Added fallback evidence: none
+
+## Checklist
+
+- [ ] The change stays behind the Gateway boundary.
+- [ ] Tests cover the affected success and failure behavior.
+- [ ] README or operator guidance was updated when commands or outcomes changed.
+- [ ] Cross-repository references are immutable and the Stack follow-up is identified.

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches:
@@ -43,6 +44,9 @@ jobs:
       - name: Test
         run: pnpm run test
 
+      - name: Check patch whitespace
+        run: git diff --check
+
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -78,7 +82,18 @@ jobs:
 
       - name: Verify license
         shell: bash
-        run: test -s LICENSE
+        run: |
+          test -s LICENSE
+          test -s README.md
+          test -s .github/pull_request_template.md
+
+      - name: Verify immutable GitHub Actions
+        shell: bash
+        run: |
+          if git grep -nE '^[[:space:]]*uses:' -- .github/workflows | grep -Ev '@[0-9a-f]{40}([[:space:]]|$)'; then
+            echo "GitHub Action is not pinned to a full commit SHA"
+            exit 1
+          fi
 
       - name: Scan tracked source for credential material
         shell: bash

.gitignore

@@ -1,10 +1,30 @@
+# Dependencies and generated frontend output
 node_modules/
+.pnpm-store/
 build/
 dist/
+.vite/
 coverage/
-.DS_Store
-*.log
-.env*
-!.env.example
+*.tsbuildinfo
+
+# Browser-test output
 test-results/
 playwright-report/
+blob-report/
+
+# Local configuration and logs
+.env
+.env.*
+!.env.example
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Editors and operating systems
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db
+
+# Linked worktrees
+.worktrees/

README.md

@@ -36,17 +36,42 @@ pnpm dev
 ## Verification
 
 ```text
+pnpm install --frozen-lockfile
 pnpm typecheck
 pnpm test
 pnpm build
 ```
 
+A successful local verification has all of these observable results:
+
+- TypeScript exits with code `0` and reports no diagnostics.
+- The Node test runner reports no failed tests.
+- Vite exits with code `0` and creates the production `dist/` directory.
+
+The Playwright suite is intentionally not a standalone mock test. It requires
+the exact Core, Samples, and Stack environment prepared by NeKiro-Stack:
+
+```text
+pnpm test:e2e
+```
+
+Success means every Playwright scenario passes against the live Gateway route;
+the Console must not connect directly to Core internals, PostgreSQL, or sample
+Agent endpoints.
+
 Console CI verifies only Console-owned behavior. Full backend/browser product
 acceptance is owned by
 [NeKiro-Stack](https://github.com/NeKiro-project/NeKiro-Stack), which checks out
 an exact Console commit and invokes the retained Playwright suite against its
 immutable component manifest.
 
+## Pull requests
+
+Pull requests must state the user-visible surface, affected Gateway contract,
+commands run, and their success signals. Contract or route changes must also
+identify the Core revision and the NeKiro-Stack manifest update that will
+verify the production browser path.
+
 ## Related repositories
 
 - [NeKiro core](https://github.com/NeKiro-project/NeKiro)