Add post-deploy smoke tests, CI summaries, and positioning Lattice nodes

gmoon · claude · gmoon · commit c3e5f7938a6d · 2026-04-02T09:59:13.000-04:00
CI/CD:
- Run smoke tests after deploy (site + subscribe API security)
- Add test summary markdown to GitHub Step Summary in both workflows

Smoke tests:
- Subscribe API: Origin check, wrong origin, oversized body, invalid email,
  honeypot discard, valid subscription, duplicate handling, CORS headers

Lattice:
- SRC-AGENT-MEMORY-ANALOGY: Agent memory lacks traceability and drift detection
- THX-BEYOND-CODE: Lattice applies beyond codebases to any knowledge system

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -45,6 +45,11 @@ jobs:
       - name: Test with coverage
         run: npm test
 
+      - name: Test summary
+        if: always()
+        run: |
+          node scripts/test-summary.mjs --md >> $GITHUB_STEP_SUMMARY || true
+
   validate-lattice:
     name: Validate Lattice Structure
     runs-on: ubuntu-latest
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -66,3 +66,14 @@ jobs:
           aws cloudfront create-invalidation \
             --distribution-id ${{ secrets.CF_DISTRIBUTION_ID }} \
             --paths "/*"
+
+      - name: Wait for CloudFront propagation
+        run: sleep 30
+
+      - name: Smoke tests
+        run: npm run test:smoke
+
+      - name: Test summary
+        if: always()
+        run: |
+          node scripts/test-summary.mjs --md >> $GITHUB_STEP_SUMMARY || true
diff --git a/.lattice/sources/SRC-COPY-REWRITE-001.yaml b/.lattice/sources/SRC-COPY-REWRITE-001.yaml
@@ -0,0 +1,9 @@
+id: SRC-COPY-REWRITE-001
+type: source
+title: Copywriting analysis and rewrite for forkzero.ai
+body: 'Internal analysis and full rewrite of forkzero.ai homepage copy. Original findings: Hero was generic, value props described features not pain points, no audience targeting. Rewrite (2026-03-21): Pain-first hero headline, Problem section, Before/After comparison table, trimmed value props, rewrote Who Its For, moved email capture up, removed What Makes It Different section, updated all meta tags.'
+status: active
+version: 1.1.1
+created_at: 2026-03-01T23:30:00.000000+00:00
+created_by: agent:claude-2026-03-01
+meta: {}
diff --git a/.lattice/sources/agent-memory-analogy.yaml b/.lattice/sources/agent-memory-analogy.yaml
@@ -0,0 +1,12 @@
+id: SRC-AGENT-MEMORY-ANALOGY
+type: source
+title: Agent memory systems are flat knowledge stores lacking traceability and drift detection
+body: 'Observed while building Claude Code memory for forkzero.ai: AI agent memory systems (Claude memory, Cursor rules, etc.) store preferences and project context as flat files with no relationships. When upstream context changes, downstream memories are not flagged for review. This is the same problem Lattice solves for codebases. Lattice applies to any knowledge system where decisions accumulate over time and need to stay current.'
+status: active
+version: 1.0.0
+created_at: 2026-04-02T13:05:45.738941+00:00
+created_by: human:george
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  reliability: blog
+  retrieved_at: 2026-04-02
diff --git a/.lattice/sources/cf-functions.yaml b/.lattice/sources/cf-functions.yaml
@@ -0,0 +1,13 @@
+id: SRC-CF-FUNCTIONS
+type: source
+title: AWS CloudFront Functions documentation
+body: Reference for CloudFront Functions (viewer-request event type, cloudfront-js-2.0 runtime). Used to implement clean URL rewriting for S3 REST API origin, which does not natively resolve /path to /path/index.html.
+status: active
+version: 1.0.0
+created_at: 2026-03-01T19:29:13.112009+00:00
+created_by: agent:claude-2026-03-01
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  url: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html
+  reliability: industry
+  retrieved_at: 2026-03-01
diff --git a/.lattice/sources/google-search-structured.yaml b/.lattice/sources/google-search-structured.yaml
@@ -0,0 +1,13 @@
+id: SRC-GOOGLE-SEARCH-STRUCTURED
+type: source
+title: 'Google Search Central: structured data guidelines'
+body: Google's requirements for structured data markup including JSON-LD format preference, required fields for BlogPosting (headline, image, datePublished, author), and rich result eligibility criteria.
+status: active
+version: 1.0.0
+created_at: 2026-03-01T19:29:08.143376+00:00
+created_by: agent:claude-2026-03-01
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  url: https://developers.google.com/search/docs/appearance/structured-data/intro-structured-data
+  reliability: industry
+  retrieved_at: 2026-03-01
diff --git a/.lattice/sources/owasp-headers.yaml b/.lattice/sources/owasp-headers.yaml
@@ -0,0 +1,13 @@
+id: SRC-OWASP-HEADERS
+type: source
+title: OWASP Secure Headers Project
+body: 'Security header recommendations: Strict-Transport-Security with preload, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy. CSP deferred due to inline styles and third-party dependencies.'
+status: active
+version: 1.0.0
+created_at: 2026-03-01T19:29:18.158186+00:00
+created_by: agent:claude-2026-03-01
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  url: https://owasp.org/www-project-secure-headers/
+  reliability: industry
+  retrieved_at: 2026-03-01
diff --git a/.lattice/sources/schema-org.yaml b/.lattice/sources/schema-org.yaml
@@ -0,0 +1,13 @@
+id: SRC-SCHEMA-ORG
+type: source
+title: Schema.org structured data documentation
+body: 'Reference for JSON-LD schema types used in pre-rendering: Organization, WebSite, SoftwareApplication, BlogPosting, WebPage, BreadcrumbList. Defines required and recommended properties for Google rich result eligibility.'
+status: active
+version: 1.0.0
+created_at: 2026-03-01T19:29:03.269356+00:00
+created_by: agent:claude-2026-03-01
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  url: https://schema.org
+  reliability: industry
+  retrieved_at: 2026-03-01
diff --git a/.lattice/sources/seo-audit-001.yaml b/.lattice/sources/seo-audit-001.yaml
@@ -0,0 +1,12 @@
+id: SRC-SEO-AUDIT-001
+type: source
+title: SEO audit findings for forkzero.ai (2026-03-21)
+body: 'Full SEO audit covering technical, on-page, content quality, and AI search readiness. Critical findings: OG image SVG not rendered by social platforms, pre-rendered meta tags mismatched React components, no privacy policy, soft 404s returning HTTP 200, trailing slash duplicate content. High findings: no About page, no llms.txt, thin content (2 blog posts), no documentation section, missing dateModified in BlogPosting schema.'
+status: active
+version: 1.0.0
+created_at: 2026-03-21T18:08:09.832050+00:00
+created_by: unknown
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  reliability: unverified
+  retrieved_at: 2026-03-21
diff --git a/.lattice/theses/beyond-code.yaml b/.lattice/theses/beyond-code.yaml
@@ -0,0 +1,16 @@
+id: THX-BEYOND-CODE
+type: thesis
+title: Lattice applies beyond codebases to any knowledge system where decisions trace back to evidence
+body: The core value of Lattice — versioned edges between decisions with drift detection — is not specific to software development. Any domain where knowledge accumulates, decisions reference prior evidence, and upstream changes should flag downstream work for review benefits from the same graph model. Agent memory, research workflows, compliance documentation, and product strategy all share this pattern.
+status: active
+version: 1.0.0
+created_at: 2026-04-02T13:05:53.437456+00:00
+created_by: human:george
+requested_by: George Moon <george.moon@gmail.com>
+meta:
+  category: value_prop
+  confidence: 0.8
+edges:
+  supported_by:
+  - target: SRC-AGENT-MEMORY-ANALOGY
+    version: 1.0.0
diff --git a/scripts/smoke.test.ts b/scripts/smoke.test.ts
@@ -10,6 +10,7 @@
 
 import { describe, it, expect } from 'vitest'
 import { blogPosts } from '../src/data/blog-posts.js'
+import { SUBSCRIBE_API_URL } from '../src/constants.js'
 
 const BASE = process.env.SITE_URL ?? 'https://forkzero.ai'
 
@@ -154,3 +155,84 @@ describe('static assets', () => {
     expect(res.headers.get('cache-control')).toContain('immutable')
   })
 })
+
+// --- Subscribe API ---
+
+async function postSubscribe(body: unknown, headers?: Record<string, string>) {
+  const res = await fetch(SUBSCRIBE_API_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: JSON.stringify(body),
+  })
+  const text = await res.text()
+  let json: Record<string, unknown> = {}
+  try {
+    json = JSON.parse(text)
+  } catch {
+    // non-JSON response
+  }
+  return { res, json }
+}
+
+describe('subscribe API — security', () => {
+  it('rejects requests without Origin header', async () => {
+    const { res, json } = await postSubscribe({ email: 'no-origin@test.com' })
+    expect(res.status).toBe(403)
+    expect(json.error).toBe('Forbidden')
+  })
+
+  it('rejects requests with wrong Origin', async () => {
+    const { res, json } = await postSubscribe({ email: 'wrong-origin@test.com' }, { Origin: 'https://evil.com' })
+    expect(res.status).toBe(403)
+    expect(json.error).toBe('Forbidden')
+  })
+
+  it('rejects oversized body', async () => {
+    const { res, json } = await postSubscribe({ email: 'a'.repeat(2000) + '@x.com' }, { Origin: 'https://forkzero.ai' })
+    expect(res.status).toBe(413)
+    expect(json.error).toBe('Request too large')
+  })
+
+  it('rejects invalid email', async () => {
+    const { res, json } = await postSubscribe({ email: 'not-an-email' }, { Origin: 'https://forkzero.ai' })
+    expect(res.status).toBe(400)
+    expect(json.error).toContain('email')
+  })
+
+  it('silently discards honeypot submissions', async () => {
+    const { res, json } = await postSubscribe(
+      { email: 'honeypot-test@test.com', website: 'http://spam.com' },
+      { Origin: 'https://forkzero.ai' },
+    )
+    expect(res.status).toBe(200)
+    expect(json.ok).toBe(true)
+  })
+})
+
+describe('subscribe API — happy path', () => {
+  it('accepts valid subscription', async () => {
+    const { res, json } = await postSubscribe(
+      { email: `smoke-test-${Date.now()}@forkzero.ai` },
+      { Origin: 'https://forkzero.ai' },
+    )
+    expect(res.status).toBe(200)
+    expect(json.ok).toBe(true)
+  })
+
+  it('handles duplicate gracefully', async () => {
+    const email = `dupe-test-${Date.now()}@forkzero.ai`
+    const headers = { Origin: 'https://forkzero.ai' }
+    await postSubscribe({ email }, headers)
+    const { res, json } = await postSubscribe({ email }, headers)
+    expect(res.status).toBe(200)
+    expect(json.ok).toBe(true)
+  })
+
+  it('returns CORS headers', async () => {
+    const { res } = await postSubscribe(
+      { email: `cors-test-${Date.now()}@forkzero.ai` },
+      { Origin: 'https://forkzero.ai' },
+    )
+    expect(res.headers.get('access-control-allow-origin')).toBe('https://forkzero.ai')
+  })
+})
