CI-only validation: final WordPress reconciliation

.github/copilot-instructions.md

@@ -0,0 +1,17 @@
+# Project continuity
+
+- Keep the currently deployed CalorieApp stable; changes to a new surface should
+  not silently deploy unrelated draft backend, identity or database work.
+- CalorieVerse is one continuously growing world. Preserve the original meadow,
+  starter identity, stable content IDs and earned progress. Internal schema
+  migrations must not create a replacement game or require a user reset.
+- Read `docs/CALORIEVERSE_LIVE_CHECKPOINT.md` before continuing CalorieVerse. The
+  larger architecture and built simulator/Studio/F&B modules are preserved in
+  PR #150 at `f8711ee`; do not repeat or discard that work.
+- Reuse the shared display-language provider and eleven-locale registry.
+- Ordinary exploration never requires a wallet, node, storage, compute or rewards.
+  Those roles need separate opt-in, resource limits, pause/resume/full stop.
+- Local guest game state is not verified reward evidence. Keep private identity,
+  food logs and credentials outside public participant storage/compute.
+- Preserve deferred architecture/governance decisions in repository documents;
+  never record secrets or temporary chat credentials.

.github/workflows/ci.yml

@@ -53,6 +53,7 @@ jobs:
           python tools/sync_identity_contracts.py --check
           python -m unittest tools.tests.test_identity_contracts
           python -m unittest tools.tests.test_localization_contracts
+          python -m unittest tools.tests.test_build_total_review_package
 
       - name: Test mobile, offline custody and tracked-secret guards
         run: |
@@ -76,7 +77,10 @@ jobs:
         run: find wordpress-plugins -type f -name '*.php' -print0 | xargs -0 -n1 php -l
 
       - name: Validate standalone Site Style package
-        run: node --test tools/tests/wordpress_site_style_package.test.mjs tools/tests/wordpress_app_origin.test.mjs
+        run: node --test tools/tests/wordpress_site_style_package.test.mjs tools/tests/wordpress_app_origin.test.mjs tools/tests/wordpress_cookie_controls.test.mjs
+
+      - name: Test read-only Site Style review inventory
+        run: php tools/tests/wordpress_site_style_review.test.php
 
       - name: Test legal footer compatibility
         shell: bash
@@ -134,6 +138,11 @@ jobs:
       - name: Build and inspect release archive
         run: python tools/build_wordpress_plugin_release.py
 
+      - name: Build and verify Site Style release
+        run: |
+          python -m unittest tools.tests.test_build_site_style_release
+          python tools/build_site_style_release.py
+
   backend-tests:
     name: Backend tests (Python 3.11)
     runs-on: ubuntu-latest
@@ -304,34 +313,18 @@ jobs:
         working-directory: frontend
         run: npm ci
 
-      - name: Audit frontend production dependencies
+      - name: Audit frontend runtime and development dependencies
         working-directory: frontend
-        run: npm audit --omit=dev --audit-level=critical
+        run: npm audit --audit-level=high
 
       - name: Lint frontend
         working-directory: frontend
         run: npm run lint
 
-      - name: Test embedded login and private account controls
-        run: >-
-          node --test
-          tools/tests/auth_callback_return.test.mjs
-          tools/tests/account_data_import_ui.test.mjs
-          tools/tests/account_data_export_validation.test.mjs
-          tools/tests/account_erasure_ui.test.mjs
-          tools/tests/account_privacy_locales.test.mjs
-          tools/tests/account_privacy_display.test.mjs
-          tools/tests/display_language_protocol.test.mjs
-          tools/tests/display_language_ui.test.mjs
-          tools/tests/testnet_entry.test.mjs
-          tools/tests/backend_proxy_logout_fallback.test.mjs
-          tools/tests/backend_warmup_rate_limit.test.mjs
-          tools/tests/calorieapp_embed_readiness.test.mjs
-          tools/tests/food_logging_ui.test.mjs
-          tools/tests/food_search_deadline.test.mjs
-          tools/tests/identity_locales.test.mjs
-          tools/tests/xaman_logout_request.test.mjs
-          tools/tests/xaman_login_start_retry.test.mjs
+      - name: Test all frontend and WordPress user flows
+        # Discover new test files automatically so follow-up checks cannot be
+        # forgotten in a manually maintained list.
+        run: node --test tools/tests/*.test.mjs
 
       - name: Build frontend
         working-directory: frontend

.github/workflows/food-ux-isolated-check.yml

@@ -0,0 +1,124 @@
+name: Food UX isolated check
+
+on:
+  push:
+    branches: [repair/food-ux-integration-20260915]
+  pull_request:
+    branches: [herstel/vervolg-20260915]
+    paths:
+      - 'frontend/**'
+      - 'backend/app/**'
+      - 'backend/tests/**'
+      - 'wordpress-plugins/calorieapp-account-profile/**'
+      - 'backend/app/schemas.py'
+      - 'backend/app/services/open_food_facts.py'
+      - 'backend/tests/test_food_log_view.py'
+      - 'backend/tests/test_open_food_facts_normalization.py'
+      - 'tools/tests/**'
+      - 'tools/build_heading_repair_release.py'
+      - 'wordpress-plugins/calorietoken-heading-repair/**'
+      - '.github/workflows/food-ux-isolated-check.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: food-ux-isolated-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+    env:
+      NEXT_TELEMETRY_DISABLED: '1'
+      CI: 'true'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Record the source under test
+        run: |
+          mkdir -p ux-check-evidence
+          git rev-parse HEAD > ux-check-evidence/verified-commit.txt
+          git rev-parse 'HEAD^{tree}' > ux-check-evidence/verified-tree.txt
+          git archive --format=tar.gz -o ux-check-evidence/verified-source.tar.gz HEAD
+      - name: Install locked dependencies and test tools
+        run: |
+          npm ci --prefix frontend --no-audit --no-fund
+          python -m pip install -r backend/requirements.txt 'playwright==1.57.0'
+          python -m playwright install --with-deps chromium
+      - name: Full regression suite and production build
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --test tools/tests/*.test.mjs 2>&1 | tee ux-check-evidence/regressions.log
+          PYTHONPATH=backend python -m pytest -q \
+            backend/tests/test_account_profile.py \
+            backend/tests/test_account_data_export.py \
+            backend/tests/test_account_data_import.py \
+            backend/tests/test_account_erasure.py \
+            backend/tests/test_database.py \
+            backend/tests/test_identity_endpoints.py \
+            backend/tests/test_inactive_account_erasure_execution.py \
+            backend/tests/test_food_log_view.py \
+            backend/tests/test_open_food_facts_normalization.py \
+            2>&1 | tee ux-check-evidence/backend-food-tests.log
+          python -m unittest tools.tests.test_build_heading_repair_release 2>&1 | tee ux-check-evidence/heading-release-tests.log
+          find wordpress-plugins/calorietoken-heading-repair -type f -name '*.php' -print0 \
+            | xargs -0 -n1 php -l 2>&1 | tee ux-check-evidence/heading-php-lint.log
+          php -l wordpress-plugins/calorieapp-account-profile/calorieapp-account-profile.php
+          php wordpress-plugins/calorieapp-account-profile/tests/profile-test.php
+          python tools/build_heading_repair_release.py \
+            --output-dir ux-check-evidence/heading-release \
+            2>&1 | tee ux-check-evidence/heading-release.log
+          cd frontend
+          ./node_modules/.bin/tsc --noEmit 2>&1 | tee ../ux-check-evidence/typecheck.log
+          npm run build 2>&1 | tee ../ux-check-evidence/build.log
+      - name: Production-browser check with synthetic backend only
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run start --prefix frontend -- --hostname 127.0.0.1 --port 3100 > ux-check-evidence/server.log 2>&1 &
+          server_pid=$!
+          trap 'kill "$server_pid" 2>/dev/null || true' EXIT
+          for i in $(seq 1 30); do curl --silent --fail http://127.0.0.1:3100/ > /dev/null && break; sleep 1; done
+          curl --silent --fail http://127.0.0.1:3100/ > /dev/null
+          # Collect every independent browser result even if one flow fails.
+          browser_failed=0
+          python tools/tests/browser_food_ux.py 2>&1 | tee ux-check-evidence/browser.log || browser_failed=1
+          python tools/tests/browser_account_profile.py 2>&1 | tee ux-check-evidence/account-profile-browser.log || browser_failed=1
+          python tools/tests/browser_account_guides.py 2>&1 | tee ux-check-evidence/account-guides-browser.log || browser_failed=1
+          HEADING_NUTRITION_EVIDENCE_DIR=ux-check-evidence/heading-nutrition-browser \
+            python tools/tests/browser_heading_nutrition.py \
+            2>&1 | tee ux-check-evidence/heading-nutrition-browser.log || browser_failed=1
+          test "$browser_failed" -eq 0
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          profile=json.loads(Path('ux-check-evidence/account-profile-browser/report.json').read_text())
+          assert profile['status']=='passed' and not profile['errors'] and len(profile['checks'])>=40, profile
+          r=json.loads(Path('ux-check-evidence/browser/report.json').read_text())
+          assert r['status']=='passed' and not r['errors'], r
+          assert len(r['checks']) >= 55 and len(r['writes']) == 1, r
+          h=json.loads(Path('ux-check-evidence/heading-nutrition-browser/report.json').read_text())
+          assert h['status']=='passed' and not h['errors'], h
+          assert len(h['checks']) >= 57, h
+          a=json.loads(Path('ux-check-evidence/account-guides-browser/report.json').read_text())
+          assert a['status']=='passed' and not a['errors'] and not a['unexpected_requests'], a
+          assert len(a['checks']) >= 40 and a['faucet_requests']==1, a
+          PY
+      - name: Retain test evidence (no publication or deployment)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: food-ux-browser-evidence
+          path: ux-check-evidence/
+          retention-days: 3
+          if-no-files-found: error

.github/workflows/wordpress-content-check.yml

@@ -0,0 +1,52 @@
+name: WordPress content styling check
+on:
+  push:
+    branches: [repair/food-ux-integration-20260915]
+    paths:
+      - 'wordpress-plugins/calorietoken-heading-repair/**'
+      - 'tools/tests/browser_wordpress_content.py'
+      - 'tools/tests/fixtures/wordpress-content/**'
+      - '.github/workflows/wordpress-content-check.yml'
+  pull_request:
+    branches: [herstel/vervolg-20260915]
+    paths:
+      - 'wordpress-plugins/calorietoken-heading-repair/**'
+      - 'tools/tests/browser_wordpress_content.py'
+      - 'tools/tests/fixtures/wordpress-content/**'
+      - '.github/workflows/wordpress-content-check.yml'
+permissions:
+  contents: read
+concurrency:
+  group: wordpress-content-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install isolated browser tools
+        run: |
+          python -m pip install 'playwright==1.57.0'
+          python -m playwright install --with-deps chromium
+      - name: Verify package and render public-content fixtures
+        run: |
+          mkdir -p ux-check-evidence
+          git rev-parse HEAD > ux-check-evidence/verified-commit.txt
+          git rev-parse 'HEAD^{tree}' > ux-check-evidence/verified-tree.txt
+          php -l wordpress-plugins/calorietoken-heading-repair/calorietoken-heading-repair.php
+          python -m unittest tools.tests.test_build_heading_repair_release
+          python tools/build_heading_repair_release.py --output-dir ux-check-evidence/heading-release
+          python tools/tests/browser_wordpress_content.py
+      - name: Retain preview and verification evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: wordpress-content-style-evidence
+          path: ux-check-evidence/
+          retention-days: 5

DATA_LICENSING.md

@@ -56,6 +56,32 @@ The current frontend bundles three dated reference-food records from USDA FoodDa
 
 The interface does not silently combine alternative energy methods, treat missing data as measured zero, or import these examples into a private diary. USDA reference provenance remains separate from Open Food Facts licensing and private user records. External names and marks retain their own rights.
 
+## USDA search catalogue — live since 15 September 2026
+
+The food-discovery continuation adds a separate, dated snapshot in
+`frontend/public/data/usda-search-foods.json`: 363 Foundation records from April
+2026 and 7,793 SR Legacy records from April 2018. It does not claim to cover all
+FoodData Central collections. The original three-food reference remains intact.
+
+The catalogue preserves FDC identifiers, English source descriptions, collection,
+edition, nutrient units and original numeric precision. Its source manifest records
+the original download URLs and archive SHA-256 values. The builder is
+`tools/build_usda_search_catalog.py`; the catalogue is kept separate from OFF data.
+FoodData Central's official [download page](https://fdc.nal.usda.gov/download-datasets/)
+and [documentation](https://fdc.nal.usda.gov/data-documentation/) describe these
+collections and reuse conditions.
+
+The browser requests one fixed first-party catalogue file only after a USDA
+search is submitted. Search matching then runs locally; no search phrase or
+account identifier is sent to USDA. Opening a source link visits USDA separately.
+Saving requires the existing explicit portion confirmation and authenticated
+backend route. The diary entry retains the USDA source, FDC identifier and chosen
+gram basis; it has no fabricated barcode or Nutri-Score.
+
+Name-based alternatives help visitors inspect other records. They are not
+personalised nutrition recommendations, allergen checks or claims of healthier
+equivalence. The visitor must check the actual label, preparation and portion.
+
 ## User and identity data
 
 Authentication identifiers and food logs are application data, not assets

README.md

@@ -31,14 +31,26 @@ Current application stack:
 - Frontend: Next.js + TypeScript + Tailwind
 - Backend: FastAPI + SQLModel
 - Data: SQLite for local development and tests; PostgreSQL is required for live user data
-- External food data: Open Food Facts search adapter; a separate three-food USDA reference selection
+- External food data: Open Food Facts search adapter; a dated USDA search catalogue and separate reference selection
 - Identity/authentication: server-side identity flow with session cookies
 
+### Live food-discovery update — 15 September 2026
+
+The live continuation adds a separate search of 8,156 dated USDA Foundation
+and SR Legacy records, an edible-gram preview, and optional similar-name food
+choices. Interface text covers the existing eleven display languages. Selecting
+a food opens the existing portion confirmation; it does not save automatically.
+The existing barcode flow is preserved. App commit `40ed5f4` was deployed and
+the new flow was checked live in all eleven interface languages. CalorieHelp
+now explains these steps on the website. See the
+[feature and validation record](docs/public/food-discovery-2026-09.md) and
+[CalorieHelp update](docs/public/caloriehelp-2026-09.md).
+
 ## Current Status
 
 ### Implemented in the repository (V2 completion in progress)
 
-The latest website package and app journey still need live owner acceptance. Current source additions include eleven-language UI synchronization, startup/rate-limit feedback, diary filtering, attributed USDA reference foods and a Testnet-guide link. Historical page translations are only partly complete; see the [dated scope and verification record](docs/public/website-update-2026-09.md).
+The food-discovery update and targeted CalorieHelp update are live. Complete mobile website acceptance and updated campaign material remain open. Existing capabilities include eleven-language UI synchronization, startup/rate-limit feedback, diary filtering, dated USDA search and reference foods, comparable-food choices and a Testnet-guide link. Historical page translations are only partly complete; see the [dated scope and verification record](docs/public/website-update-2026-09.md).
 
 - Food search via backend integration with Open Food Facts
 - Nutrition result display in the web UI

THIRD_PARTY_NOTICES.md

@@ -27,3 +27,16 @@ source-clearance work are recorded in
 `DATA_LICENSING.md`.
 
 The standalone WordPress Site Style component in `wordpress-plugins/calorietoken-site-style/` also declares GPL-2.0-or-later. Its packaged licence applies to its code. Historical site images/fonts remain references to the existing site and retain their original rights; they are not granted a new licence here. The display-language runtime is shared with CalorieApp.
+
+The optional-on-use food barcode decoder bundles `@zxing/browser` 0.1.5 (MIT),
+`@zxing/library` 0.21.3 (Apache-2.0, with its included additional notices), and
+`ts-custom-error` as resolved in the lockfile (MIT). Complete upstream texts
+are retained at `frontend/public/barcode-licenses.txt`, served with the app.
+The libraries decode locally; no CDN service or external image processing is
+used. This does not relicense the surrounding CalorieApp or brand.
+
+The ZXing library's npm metadata says MIT, while its shipped LICENSE retains
+Apache-2.0 and additional upstream notices. This release preserves that full
+file and does not treat the metadata as a blanket relicense. The optional
+`@zxing/text-encoding` 0.9.0 dependency's complete LICENSE.md is retained too;
+it identifies its public-domain/Apache-2.0 terms and Encoding Standard material.

backend/README.md

@@ -87,3 +87,22 @@ migration or verified restore.
   later without paywalling identity or personal-data rights.
 - Open Food Facts is consumed only by backend service endpoints and is the
   current adapter, not the canonical or exclusive food-data model.
+
+
+### Public product search
+
+Name searches use Open Food Facts' indexed Search-a-licious API. The request is
+read-only, sends only literal product-name text and requested nutrition/display
+fields, and supports the application's eleven display languages. One bounded
+legacy CGI transport fallback is allowed after a transport or invalid-response
+failure, never after a provider HTTP rejection (including 429/503). Barcode
+lookup continues to use the exact v3 product endpoint and GTIN verification.
+
+Successful results are cached for one hour in a 256-entry process-local cache.
+Case and repeated whitespace share one name-search key. A cached answer remains
+available during a provider cooldown, without another source request. Empty or
+failed responses are not cached. The cache is lost on restart; it is not a local
+copy of the complete OFF database. Existing shared PostgreSQL egress quotas,
+queue limits, duplicate coalescing and Retry-After pauses remain in force.
+
+Source documentation: https://openfoodfacts.github.io/search-a-licious/users/ref-openapi/