Pre-launch — quality & security bar (v2.1)

Status (2026-05-19): Targets still binding. v2.1 surfaces to cover with Lighthouse: /, /walkthrough/*, /feed, /sign-in.

Lighthouse / Core Web Vitals

Target: Lighthouse ≥ 90 on B2C onboarding URL (mobile), manual monthly.
Command (local): Chrome DevTools → Lighthouse → export HTML report to artifacts/lighthouse/.
Track LCP / CLS via PostHog + manual Lighthouse runs (Hetzner host, no Vercel Speed Insights).

Scope: production-like staging + B2B API + admin surfaces.
Exit: 0 critical, 0 high unresolved at launch; mediums documented with timeline.

Admin route: /admin/audit — tail of audit_log + global chain verification status.

CI gate: GitHub Actions (.github/workflows/dos-ci.yml) runs typecheck/lint/test/build + secret scan on every PR; deploy.yml is *intended* to auto-deploy to prod on merge to main but deploy.yml has never successfully run — it dies at the Tailscale step unless TS_OAUTH_CLIENT_ID/TS_OAUTH_SECRET are set as repo secrets. Until they are, every prod deploy is manual (./infra/hetzner/deploy-web-hetzner.sh). Verify with gh run list --workflow=deploy.yml before assuming a merge deployed anything. Local Jenkins (docs/jenkins.md) may still run in parallel — not reconfirmed.
Dependabot weekly merges with CI green
Review Cloudflare (Access + WAF) rules quarterly