[WEB.40] Blazor WebAssembly migration of Web: C# Site, Account and Chat profiles, TypeScript thin Worker, React retired

[deku2026]

Claim: WEB.40 epoch 1 (w-deku-20261008-web-40)

Task record: web lane, task-web-40. Authority: P2-021 (C#-first: Web moves to Blazor WebAssembly; TypeScript only for the thin Cloudflare Worker adapter), plus the coordinator adjudications recorded for WEB.40 (sequencing, deploy switch, Site interactivity, parity waiver, focus option (a), accessibility re-proof).

What this changes

• Public Site: a static C# Site, generated by the first-party Razor HtmlRenderer generator in tools/ArcForges.Web.Tooling. Its output is deterministic, as a repeated build shows. It needs no Blazor boot for public pages.

• Account and Chat: Blazor WebAssembly profiles (src/ArcForges.Web.App) on generated C# gRPC-Web clients, with session and CSRF handling, CSP, exact int64/uint64/decimal, and typed failure states. The Operations profile skeleton is in place. The owned design system is ArcForges.Web.Ui.

• Worker: the canonical-host Worker is converted to TypeScript as a thin adapter, with no business decision and no authoritative state.

• Deploy switch: the candidate seal and verifier, CI and the main-push Cloudflare deploy now operate on the C# Site and Blazor outputs. The guards are unchanged: sealed candidate, verification before upload, main-push only, no workers.dev and no previews.

• React retirement: the React apps, the npm test toolchain, the npm Contracts packages and the Prettier and Biome gates are retired. The record is in docs/web-40-react-retirement.md.

• Parity: normalised-DOM parity against the recorded React prerender (docs/web-40-site-parity.md) shows 0 differences on /, /hello/, /cloud-hello/ and /404.html, with byte-identical static assets and stylesheet pair.

• Accessibility re-proof (P2-021 item 8): docs/web-40-accessibility.md covers 14 screen states with 0 axe violations (axe-core 4.13.0 in Chrome 156.0.8078.12, local opt-in), and a WCAG 2.2 A and AA checklist per state. Fixed on the way:

  • 1.4.11: App input boundaries raised to 4.0 to 4.5:1;
  • 2.1.1 and 4.1.2: the error banner Dismiss is now a named keyboard button;
  • the axe region rule: the banner message sits in role=alert.

  The judgement items and the human assistive-technology session remain open and are not claimed.

• Policy: the GOV.11 policy suite is ported to C#. NuGet admission successor receipts run up to web-40-admission-r14, all naming the reviewer.

Scope notes

• ADP-07 supporting-file binding. These files are outside the recorded writes and are changed only as the migration requires: global.json (SDK 10.0.401), Directory.Build.props, .editorconfig, the vendored eng/naming tool (digest-pinned by eng/policy/naming-candidate.json), the eng/contracts PublicApi copy, eng/version-sources.json, and the root README.md, AGENTS.md, CONTRIBUTING.md and THIRD_PARTY_NOTICES.md. The retired React, Prettier, VS Code and Playwright configurations are deleted.
• Node build tooling (coordinator adjudication of 2026-10-09, applied by the pending planning repair P2-026): Web's Node TypeScript build, policy and provenance tooling and its node:test provenance tests stay as repository build tooling, with no business decision or authoritative state. Their C# port is recorded as out of scope, not completed.
• Receipt r14 rationale. Its convention sentence is inaccurate. The rows are correct: each row's contentHash equals the packages.lock.json and .nupkg.metadata contentHash, not the .nupkg file SHA-512, and nuspecSha256 is the SHA-256 of the restored .nuspec bytes including the BOM. The next Web successor receipt corrects the sentence; committed receipts are not rewritten.
• Streaming: WEB.40 has no streaming surface, because the retired React app was unary only. The streaming proof belongs to PRF.11.

Validation actually performed

• Coordinator, through the workstation build slot at 58f44c4:
  • full-local passed: locked restore, dotnet format, build, candidate publish, all test suites, profile publishes, Site build with determinism repeat and diff, browser build;
  • a11y-parity passed: the parity and axe suites.
• Reviewer at 6ff8e1e:
  • dependency check (114 dependencies, 39 inputs), typecheck, test:dependencies 15/15, npm tests 88/88, and licence-evaluated;
  • the policy wrapper, with the Node 24.20 versus 24.21 pin gap stubbed;
  • every admission row verified against the restored packages.
• Not run locally: gitleaks (not installed; hosted secret-scan is authoritative), and the Node 24.21 toolchain gate (local Node 24.20; hosted CI is authoritative).

🤖 Generated with Claude Code

[deku2026]

Reviewed 6ff8e1e for [WEB.40] epoch 1: approved

Reviewer: independent session w-deku-20261008-rev-web-40, which authored none of this.

Rounds: round 1 at 58f44c4 had a material finding in the admission records (nuspec digest convention). It was fixed in 6ff8e1e by successor receipt web-40-admission-r14, the restored-nuspec comparison in the policy test, and the .gitleaks.toml path widening. Round 2 approved.

Verified at the exact head:

• the delta since the coordinator's full-local and a11y-parity runs at 58f44c4: 5 files, with no UI or browser source change since 73173c2;
• through the build slot:
  • check:dependencies (114 dependencies, 39 inputs);
  • the policy wrapper, with only the Node 24.20 vs 24.21 assertion stubbed, covering the licence, provenance, naming, lock-provenance and wrangler-routing audits;
  • typecheck;
  • test:dependencies 15/15 and npm tests 88/88;
  • licence-evaluated;
  • C# policy tests 107/107 and dotnet format;
• admission:
  • 71/71 nuspecSha256 rows equal the restored .nuspec bytes;
  • contentHash equals the lock and .nupkg.metadata values (69 lock rows);
  • every receipt on the active path names this reviewer;
• the accessibility record:
  • 14/14 states internally consistent;
  • all 113 "pass (axe)" cells backed by a default-enabled axe-core 4.13.0 rule that passed on that state;
  • no confirmed WCAG 2.2 AA failure on a required screen;
• deploy readiness: the main-push-only, sealed-candidate and verify-before-upload guards are intact.

Non-blocking (recorded; see the PR body):

• the r14 rationale sentence;
• gitleaks is hosted-only;
• accessibility record refinements (2.5.8 spacing exception; the skip-link criterion; commit or hash the axe report);
• ADP-07 out-of-writes paths;
• the retained Node build tooling (coordinator adjudication, P2-026);
• a test that passes silently for unrestored CON.07 rows;
• a comment naming the wrong emitter;
• streaming has no WEB.40 surface (PRF.11).

Posted by the coordinator under the 2026-10-08 publication protocol.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[deku2026]

Reviewed efe7872 for [WEB.40] epoch 1: approved (delta review over the approved 6ff8e1e, including the named exact-head exception review of the .gitleaks.toml change).

Reviewer: independent session w-deku-20261008-rev-web-40.

Hosted failures at 6ff8e1e, each root-caused and reproduced under CI conditions:

• Node: csharp-candidate.test.ts built a local identity while GITHUB_ACTIONS=true. The test now reads it with the GITHUB_* variables cleared; the production assertion is unchanged.
• Windows C# job: the hosted windows image preinstalls the wasm-tools workload, so no NuGet copy of the browser-wasm runtime pack is restored. An explicit per-OS PacksFolderRows table now covers it: a Windows row requiring the content marker runtimes/browser-wasm/native/dotnet.native.wasm, and a Linux row. The empty-folder and partial-folder negative controls fail closed.
• gitleaks: one generic-api-key false positive at eng/contracts/ArcForges.Contracts.PublicApi/1.0.0-ci.287.1/source.json:9. The value is the SHA-256 of the packaged native-auth schema, verified against the cached nupkg. A path-, rule- and line-bound allowlist covers it, and the regex matches exactly one tracked line.
• Receipt web-40-admission-r15 (chained from r14, which is unedited) records the scanner exception and the packs table, and corrects the r14 contentHash sentence.

Verified at efe7872, through the build slot:

• dotnet format on all 11 projects, plus build;
• the Policy suite 108/108, in both the default and the Windows-like packs layouts;
• npm tests 88/88, with and without CI variables;
• typecheck, check:dependencies and test:dependencies 15/15;
• the policy() steps, with only the Node 24.21 pin assertion stubbed.

Non-blocking:

• a zero-byte marker would still satisfy the Windows row;
• gitleaks itself runs hosted.

Merge waits for the planning repair P2-026, because WEB.40's retained Node build tooling is recorded there (coordinator adjudication S17).

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed 4cca32e for [WEB.40] epoch 1: approved (delta review over the approved efe7872; coordinator decision S20(a)).

Reviewer: independent session w-deku-20261008-rev-web-40.

The delta:

• a deterministic web-site-<sha256>.tar built with the existing ustar writer, sealed as a candidate root member, and verified (exactly one archive, name equal to digest, bytes equal to the regenerated Site archive);
• main-push release upload only;
• the root index.html.br and index.html.gz excluded from web-profiles;
• the Cloudflare deploy serving is unchanged (assets ./assets, no tar);
• receipt web-40-admission-r16 is chained from r15 and changes only the ci.yml input.

Verified:

• a full CI-shaped run in clean clones: restore, format, build, all C# tests, candidate build twice and compare, verify, bundle and repeat bytes, release simulation, deploy dry-run, typecheck, npm tests 94/94, and the dependency checks;
• the Site archive is byte-identical across two separate checkouts;
• the naming failure in clones came from the local-path git remote: with the GitHub origin it passes (0 findings).

Non-blocking:

• The profile bundle differs across separate checkouts, though it is identical within one build. Razor-generated sources embed the absolute checkout path (#line, #pragma checksum), which changes the PDB, the MVID and the wasm fingerprint. This predates the delta, and no WEB.40 claim depends on cross-checkout identity. A follow-up PathMap or ContinuousIntegrationBuild setting would make it reproducible.
• docs/profile-bundle.md "deterministic" should read "within one build".
• The dry-run's .wrangler/tmp can reach the release candidate archive.

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed c58e528 for [WEB.40] epoch 1: approved (delta review over the approved 4cca32e).

Reviewer: independent session w-deku-20261008-rev-web-40.

Hosted actionlint reported SC2012 (ls) at ci.yml:408, the main-push Site archive step. The step now uses a nullglob array, requires exactly one web-site-*.tar, and requires its name to equal web-site-<sha256 of bytes>.tar.

The extracted step was run under bash -euo pipefail:

• zero archives, a mismatched name, two archives, an unrelated file and a .tar.gz all fail;
• one correctly named archive passes.

Also verified:

• actionlint is clean on all workflows;
• dependency-policy.ts passes (114 dependencies, 39 inputs);
• auditProvenance passes (304 files, dirty false);
• r17 differs from r16 only in the ci.yml input hash, which equals the committed file's sha256 (45457067...), and in its links and rationale. It names this reviewer.

Merge waits for planning repair P2-026 (coordinator adjudication S17).

Posted by the coordinator under the 2026-10-08 publication protocol.