Harden control plane boundaries

src/backend/buildEngine.test.ts

@@ -79,10 +79,14 @@ test("equivalent resolved inputs are byte-identical despite different run IDs",
     assert.equal(first.input.artifactBuildId, second.input.artifactBuildId);
     const engine = new BuildEngine(output);
     const one = engine.build(first.input);
-    assert.equal(fs.statSync(one.outputDirectory).mode & 0o777, 0o750);
+    if (process.platform !== "win32") {
+      assert.equal(fs.statSync(one.outputDirectory).mode & 0o777, 0o750);
+    }
     fs.chmodSync(one.outputDirectory, 0o700);
     const two = engine.build(second.input);
-    assert.equal(fs.statSync(two.outputDirectory).mode & 0o777, 0o750);
+    if (process.platform !== "win32") {
+      assert.equal(fs.statSync(two.outputDirectory).mode & 0o777, 0o750);
+    }
     assert.equal(one.artifactChecksum, two.artifactChecksum);
     assert.equal(one.outputDirectory, two.outputDirectory);
     assert.deepEqual(one.generatedFiles, two.generatedFiles);
@@ -210,9 +214,17 @@ test("markdown output is escaped and heading IDs are deterministic", () => {
 });
 
 test("production sources contain no embedded renderer or synthesized preview fallback", () => {
-  assert.equal(fs.readFileSync(path.resolve("src/backend/buildEngine.ts"), "utf8").trim(), 'export * from "./repositoryBuildEngine";');
+  const boundary = fs.readFileSync(path.resolve("src/backend/buildEngine.ts"), "utf8");
+  assert.match(boundary, /AI or other open-schema output is never a release input/);
+  assert.match(boundary, /export \* from ".\/repositoryBuildEngine"/);
   const server = fs.readFileSync(path.resolve("server.ts"), "utf8");
   assert.doesNotMatch(server, /cdn\.tailwindcss\.com|Simple HTML renderer|SITE HEADER/);
-  assert.match(server, /E_RELEASE_UNAVAILABLE/);
-  assert.match(server, /E_CONFIG_READ_ONLY/);
+  assert.doesNotMatch(server, /child_process|execAsync/);
+  const preview = fs.readFileSync(path.resolve("src/backend/http/previewRouter.ts"), "utf8");
+  const control = fs.readFileSync(path.resolve("src/backend/http/controlRouter.ts"), "utf8");
+  const storeSource = fs.readFileSync(path.resolve("src/backend/store.ts"), "utf8");
+  assert.match(preview, /E_RELEASE_UNAVAILABLE/);
+  assert.match(control, /E_CONFIG_READ_ONLY/);
+  assert.match(storeSource, /REMOTE_PUBLICATION_IMPLEMENTED = false as const/);
+  assert.doesNotMatch(storeSource, /REMOTE_PUBLICATION_IMPLEMENTED\s*=\s*process\.env/);
 });