Fix fail-closed G.A.T.E. validation for live deploy receipts

[Copilot]

Canonical issue

This patch closes the fail-closed validation gap in the Studio G.A.T.E. flow: a caller could force a real Zero-Sim verdict without evidence and claim a live deploy receipt without a verified https:// hostname.

Outcome

The Studio deploy gate now holds or rejects invalid live claims unless the evidence is real and the presented URL passes the verified live-receipt bar. The user flow remains the same — Attempt deploy, evaluate G.A.T.E., and render a visible decision chip — but the UI no longer overclaims success on absent or malformed receipts.

Scope

• Included:
  • Hardened assessZeroSim so a fabricated real verdict is downgraded to unverified when evidence is missing.
  • Enforced fail-closed behavior for malformed live URLs and empty/weak evidence before a deploy can be marked live.
  • Guarded transition evaluation against missing authority/transition data to avoid bypass or null-driven behavior.
  • Added a regression test covering the invented-live-proof case.
• Explicitly excluded:
  • No product flow changes beyond the deployment gate.
  • No Vercel or production deployment mutations.
  • No unrelated UI or backend behavior changes.

Risk

• Risk level: low
• Failure mode: a malformed or incomplete deploy attempt may be held rather than incorrectly marked live.
• Rollback: revert the apps/web/src/lib/gate-transition.ts validation change and the corresponding regression test.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests — cd /home/runner/work/EventRelay/EventRelay/apps/web && npm test -- --run src/lib/__tests__/gate-transition.test.ts src/lib/__tests__/studio-pipeline-status.test.ts on d556b5779ea34270a390eb8e09869543c82335db
• Required CI — CodeQL Security Scan (javascript): 0 alerts on d556b5779ea34270a390eb8e09869543c82335db
• Review threads resolved — no review comments found for the patch on d556b5779ea34270a390eb8e09869543c82335db

Production evidence

Not applicable. This patch changes client-side validation logic only; it does not create or claim a new Vercel preview or production deployment.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:53pm UTC