Codex/foundation section 14 content

.config/dotnet-tools.json

@@ -4,10 +4,8 @@
   "tools": {
     "husky": {
       "version": "0.9.1",
-      "commands": [
-        "husky"
-      ],
+      "commands": ["husky"],
       "rollForward": false
     }
   }
-}
+}

.editorconfig

@@ -24,6 +24,10 @@ generated_code = true
 # C# files
 [*.cs]
 end_of_line = lf
+# Enforce two focused, existing code-style expectations in format/build checks.
+dotnet_diagnostic.IDE0040.severity = warning
+dotnet_diagnostic.IDE0044.severity = warning
+dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
 # New line preferences
 csharp_new_line_before_open_brace = all
 csharp_new_line_before_else = true
@@ -179,12 +183,17 @@ trim_trailing_whitespace = false
 [*.{props,targets,config}]
 indent_size = 2
 
-# Data serialization
-[*.{json,yaml,yml}]
+# Prettier owns first-party content formatting. Preserve authored prose wrapping.
+[*.{md,json,jsonc,yaml,yml,css,js,mjs,cjs}]
 indent_size = 2
+end_of_line = lf
 
 # Shell scripts
 [*.sh]
+indent_size = 2
+end_of_line = lf
+[.husky/pre-commit]
+indent_size = 2
 end_of_line = lf
 [*.{cmd,bat}]
 end_of_line = crlf

.gitattributes

@@ -15,11 +15,15 @@
 *.html text eol=lf
 *.css text eol=lf
 *.js text eol=lf
+*.mjs text eol=lf
+*.cjs text eol=lf
+*.jsonc text eol=lf
 *.ts text eol=lf
 Caddyfile* text eol=lf
 
 # Scripts
 *.sh text eol=lf
+.husky/pre-commit text eol=lf
 *.ps1 text eol=crlf
 *.bat text eol=crlf
 

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,7 +1,6 @@
 name: Bug Report
 description: Report something broken or not working as expected.
-labels: ["needs triage"]
-type: bug
+type: Bug
 
 body:
   - type: markdown
@@ -11,7 +10,7 @@ body:
 
         Please do not include passwords, tokens, private information, security vulnerability details, sensitive material, archived game dumps, original proprietary assets, or decompiled source code.
 
-        Security issues should be reported privately using `SECURITY.md`.
+        Security issues should follow the [private reporting instructions](https://github.com/OpenGameBuilder/opengamebuilder/blob/main/SECURITY.md).
 
   - type: checkboxes
     id: preflight

.github/ISSUE_TEMPLATE/compatibility_issue.yml

@@ -1,7 +1,6 @@
 name: Compatibility Issue
 description: Report behavior that differs from MyGameBuilder or affects restored games.
-labels: ["needs triage"]
-type: compatibility
+type: Bug
 
 body:
   - type: markdown
@@ -53,18 +52,6 @@ body:
     validations:
       required: false
 
-  - type: dropdown
-    id: area
-    attributes:
-      label: Affected area
-      description: Best guess is fine.
-      multiple: true
-      options:
-        - TODO
-        - Other
-    validations:
-      required: false
-
   - type: textarea
     id: evidence
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1,8 @@
 blank_issues_enabled: false
+contact_links:
+  - name: Questions and ideas
+    url: https://github.com/OpenGameBuilder/opengamebuilder/discussions
+    about: Ask for help, discuss an idea, or explore a possible contribution in public.
+  - name: Private security report
+    url: https://github.com/OpenGameBuilder/opengamebuilder/security/advisories/new
+    about: Report a suspected vulnerability privately. Do not open a public issue.

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -1,7 +1,6 @@
 name: Enhancement
 description: Suggest an improvement to something that already exists.
-labels: ["needs triage"]
-type: enhancement
+type: Enhancement
 
 body:
   - type: markdown
@@ -11,7 +10,7 @@ body:
 
         Use this form for improvements to existing behavior, UI, UX, developer experience, documentation, tooling, or project workflow.
 
-        For entirely new capabilities, use the Feature Request form instead. If the idea is broad or exploratory, the Discord server may be a better fit.
+        For entirely new capabilities, use the Feature Request form instead. For broad or exploratory ideas, start a [GitHub Discussion](https://github.com/OpenGameBuilder/opengamebuilder/discussions).
 
         Please do not include private information, security vulnerability details, sensitive material, archived game dumps, original proprietary assets, or decompiled source code.
 

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,15 +1,14 @@
 name: Feature Request
-description: Suggest an improvement or new feature.
-labels: ["needs triage"]
-type: feature
+description: Propose a new capability.
+type: Feature
 
 body:
   - type: markdown
     attributes:
       value: |
-        Thanks for suggesting an improvement.
+        Thanks for suggesting a new capability.
 
-        Use this form for specific feature requests. If the idea is broad or exploratory, the Discord server may be a better fit.
+        Use this form for specific new capabilities. For improvements to existing behavior, use the Enhancement form. For broad or exploratory ideas, start a [GitHub Discussion](https://github.com/OpenGameBuilder/opengamebuilder/discussions).
 
         Please do not include private information, security vulnerability details, sensitive material, archived game dumps, original proprietary assets, or decompiled source code.
 
@@ -27,7 +26,7 @@ body:
     id: summary
     attributes:
       label: What would you like to see?
-      description: Briefly describe the feature or improvement.
+      description: Briefly describe the new capability.
     validations:
       required: true
 

.github/actionlint.yaml

@@ -0,0 +1,13 @@
+# actionlint 1.7.12 predates GitHub's cache-mode key. Keep the security setting;
+# check-content.mjs separately requires none in these deployment entry points.
+# Remove only these exceptions when a pinned actionlint release supports the key.
+paths:
+  .github/workflows/_deploy.yml:
+    ignore:
+      - '^unexpected key "cache-mode" for "workflow" section\.'
+  .github/workflows/cd-production.yml:
+    ignore:
+      - '^unexpected key "cache-mode" for "workflow" section\.'
+  .github/workflows/cd-staging.yml:
+    ignore:
+      - '^unexpected key "cache-mode" for "workflow" section\.'

.github/actions/validate/action.yml

@@ -1,5 +1,5 @@
 name: Validate solution
-description: Shared restore, formatting, Release build, and test gate for CI and deployment.
+description: Shared solution, frontend packaging, and smoke-package validation for CI and deployment.
 
 inputs:
   checkout-ref:
@@ -13,6 +13,10 @@ inputs:
   artifact-name:
     description: Unique name for this job's failure diagnostics.
     required: true
+  publish-web:
+    description: Publish and verify the frontend; disable only when the caller has a separate required packaging job.
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -29,72 +33,22 @@ runs:
       with:
         global-json-file: ${{ inputs.working-directory }}/global.json
 
-    - name: Prepare validation diagnostics
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: mkdir -p artifacts/validation
-
-    - name: Restore
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: dotnet restore opengamebuilder.slnx 2>&1 | tee artifacts/validation/restore.log
-
-    - name: Verify formatting
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: >
-        dotnet format opengamebuilder.slnx --verify-no-changes --no-restore
-        --report artifacts/validation/format.json
-        2>&1 | tee artifacts/validation/format.log
-
-    - name: Build
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: >
-        dotnet build opengamebuilder.slnx --configuration Release --no-restore
-        2>&1 | tee artifacts/validation/build.log
-
-    - name: Test
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: >
-        dotnet test --solution opengamebuilder.slnx --configuration Release --no-build
-        2>&1 | tee artifacts/validation/test.log
-
-    - name: Test release scripts without external writes
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: |
-        set -o pipefail
-        bash tests/release-scripts/run.sh 2>&1 | tee artifacts/validation/release-scripts.log
-
-    - name: Test edge deployment without Docker or SSH
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: |
-        set -o pipefail
-        bash tests/deploy-edge/run.sh 2>&1 | tee artifacts/validation/deploy-edge.log
-
-    - name: Test shared and separate host configuration without a Docker daemon
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}
-      run: |
-        set -o pipefail
-        bash tests/deploy-topology/run.sh 2>&1 | tee artifacts/validation/deploy-topology.log
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: "22"
+        package-manager-cache: false
 
-    - name: Test application rollback without Docker or SSH
-      shell: bash
+    - name: Install pinned content tools
+      shell: pwsh
       working-directory: ${{ inputs.working-directory }}
-      run: |
-        set -o pipefail
-        bash tests/deploy-app/run.sh 2>&1 | tee artifacts/validation/deploy-app.log
+      run: ./scripts/install-content-tools.ps1
 
-    - name: Verify supply-chain pins
-      shell: bash
+    - name: Run shared full check
+      shell: pwsh
       working-directory: ${{ inputs.working-directory }}
-      run: |
-        set -o pipefail
-        bash tests/supply-chain/run.sh 2>&1 | tee artifacts/validation/supply-chain.log
+      env:
+        PUBLISH_WEB: ${{ inputs.publish-web }}
+      run: ./scripts/check.ps1 full -SkipWebPublish:($env:PUBLISH_WEB -eq 'false')
 
     - name: Upload validation failure diagnostics
       if: ${{ failure() && !cancelled() }}

.github/dependabot.yml

@@ -39,6 +39,37 @@ updates:
     cooldown:
       default-days: 7
 
+  # Browser-smoke dependencies, including Playwright and its browser revisions.
+  - package-ecosystem: "npm"
+    directory: "/tests/deploy-smoke"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:30"
+      timezone: "America/Indiana/Indianapolis"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps"
+      include: "scope"
+    cooldown:
+      semver-major-days: 14
+      semver-minor-days: 3
+      semver-patch-days: 1
+
+  # First-party formatting and Markdown lint dependencies.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:45"
+      timezone: "America/Indiana/Indianapolis"
+    open-pull-requests-limit: 3
+    cooldown:
+      semver-major-days: 14
+      semver-minor-days: 3
+      semver-patch-days: 1
+
   # GitHub Actions used by workflows in .github/workflows.
   - package-ecosystem: "github-actions"
     directory: "/"

.github/pull_request_template.md

@@ -1,3 +1,6 @@
+<!-- markdownlint-disable MD041 -->
+<!-- This is a PR body template; GitHub supplies its top-level title. -->
+
 ## Summary
 
 Describe what this pull request changes.

.github/workflows/_deploy.yml

@@ -69,6 +69,8 @@ jobs:
           checkout-ref: ${{ needs.resolve-source.outputs.protected-revision }}
           working-directory: deployment-source
           artifact-name: ${{ inputs.environment-slug }}-validation
+          # The required package job below publishes and verifies the deployable frontend.
+          publish-web: "false"
 
   package:
     name: Package portable web client
@@ -95,11 +97,10 @@ jobs:
           cache: false
 
       - name: Publish web client
-        run: >
-          dotnet publish
-          src/OpenGameBuilder.Web.Client/OpenGameBuilder.Web.Client.csproj
-          --configuration Release
-          --output ./artifacts/web
+        run: |
+          dotnet --version
+          dotnet publish src/OpenGameBuilder.Web.Client/OpenGameBuilder.Web.Client.csproj \
+            --configuration Release -p:RestoreLockedMode=true --output ./artifacts/web
 
       - name: Locate web publish output
         run: |
@@ -293,13 +294,13 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '22'
+          node-version: "22"
 
       - name: Install browser smoke dependencies
         run: |
           npm ci --prefix tests/deploy-smoke
           cd tests/deploy-smoke
-          npx playwright install --with-deps chromium
+          node node_modules/playwright/cli.js install --with-deps chromium
 
       - name: Transfer candidate release
         env:
@@ -358,7 +359,7 @@ jobs:
             echo "Repository variable '${{ inputs.smoke-test-url-var }}' is not set." >&2
             exit 1
           fi
-          node tests/deploy-smoke/smoke.mjs
+          pwsh -NoProfile -File scripts/check.ps1 browser
 
       - name: Rehearse staging rollback after a successful browser check
         if: ${{ inputs.environment-slug == 'staging' && inputs.rehearse-rollback }}