| 1 | Pages are exactly / and /tool-calling | src/contracts/surface.test.ts → serves exactly the inventoried pages |
| 2 | Local route handlers are exactly the three inventoried /api routes | src/contracts/surface.test.ts → serves exactly the inventoried local route handlers |
| 3 | One root layout plus the shared error and global error boundaries | src/contracts/surface.test.ts → keeps one root layout |
| 4 | No dynamic or catch-all segments that could shadow proxied /api paths | src/contracts/surface.test.ts → has no catch-all or dynamic segments |
| 5 | No server actions | src/contracts/surface.test.ts → declares no server actions |
| 6 | No execution or cross-origin messaging primitives: iframes, srcdoc, postMessage, message listeners, workers, service workers, eval, new Function, string timers, dangerouslySetInnerHTML, child_process, vm, window.open, document.domain | src/contracts/surface.test.ts → isolation: no execution surface |
| 7 | Client code fetches only same-origin relative /api paths | src/contracts/surface.test.ts → only fetches same-origin relative /api paths |
| 8 | Client code reads no non-public environment variables | src/contracts/surface.test.ts → reads no server secrets from client code |
| 9 | No X-Powered-By header | src/contracts/next-config.test.ts → hides the framework fingerprint header |
| 10 | frame-ancestors 'none' and X-Frame-Options: DENY on pages, local routes and proxied API paths | src/contracts/next-config.test.ts → denies framing of every playground path |
| 11 | No app-specific framable exceptions beyond the platform list | src/contracts/next-config.test.ts → adds no app-specific framable exceptions |
| 12 | Every response carries the private X-Robots-Tag explicitly from next.config.ts; Playground is unlisted and crawling is disallowed | src/contracts/next-config.test.ts → sets the private robots header; src/contracts/seo.test.ts → stays out of public SEO surfaces |
| 13 | Only unmatched /api/* proxies to the configured Web origin, after local routes; no beforeFiles or afterFiles rewrites | src/contracts/next-config.test.ts → proxies only unmatched /api paths to web |
| 14 | Deployed builds default the Web origin to https://tuturuuu.com | src/contracts/next-config.test.ts → defaults the proxied web origin |
| 15 | Remote image optimization is https-only | src/contracts/next-config.test.ts → only optimizes remote images over https |
| 16 | No custom redirects | src/contracts/next-config.test.ts → declares no custom redirects |
| 17 | The proxy matches pages and API paths while excluding framework assets and dotted paths | src/proxy.test.ts → matches pages and api but not framework assets |
| 18 | Local and proxied API requests pass the shared guard with the proxy:playground:api prefix | src/proxy.test.ts → guards local and proxied API requests |
| 19 | A guard rejection is returned unchanged | src/proxy.test.ts → returns the guard rejection unchanged |
| 20 | Signed-out pages redirect to Web sign-in with the original return URL; supported session cookies pass to the server staff gate | src/proxy.test.ts → redirects signed-out %s to web sign-in; lets a %s through to the page |
| 21 | A guard failure is raised, never treated as a pass | src/proxy.test.ts → propagates guard failures |
| 22 | Every local route handler exposes only GET | src/app/api/routes.test.ts → exposes only GET |
| 23 | /api/ai/tool-calling requires verified root staff and returns {} with no model call; both AI routes return 401 signed out and 403 for non-staff or missing root membership | src/app/api/routes.test.ts → tool-calling returns an empty JSON object for staff; src/app/api/ai/routes.test.ts → returns 401 / 403 |
| 24 | /api/build-info returns uncached JSON | src/app/api/routes.test.ts → build-info returns uncached JSON |
| 25 | /api/ai/object-generation reads no request input, uses a fixed server prompt, the raw pinned model for verified root staff without AI memory writes, and passes no tools | src/app/api/routes.test.ts → object-generation takes no request input |
| 26 | Object generation output is validated against the task schema | src/app/api/routes.test.ts → validates model output against the task schema |
| 27 | Provider failures surface as errors | src/app/api/routes.test.ts → surfaces provider failures as errors |
| 28 | i18n is English-only with an empty catalog | src/i18n/request.test.ts → is English-only with no message catalog |
