[ExtraToast]

PLATFORM.md documents ./platform/render-local.sh as the local CI-parity gate whose scorecard must pass before committing. The script could never complete. Five independent defects, each verified by running the published toolkit rather than reading the code:

defect	evidence
every render passed a directory as --output	toolkit opens --output as a file → EISDIR: illegal operation on a directory on all five fragments
artifact leak-scan	not a subcommand — artifact exposes only emit-apply-bundle, emit-contract, emit-kustomization-health; CI leak-scans via the actions/leak-scan composite action
artifact emit-contract	called with --schema-version (not a flag) and without the required --deployment and --context → E_USAGE
artifact validate-raw-manifests	exists in no published version
kubeconform / kustomize build on out/manifests	a fragment is a schema document wrapping its payload; both tools expect top-level apiVersion/kind and always fail on that shape

That last one is not a guess: actions/deploy-artifact/run.sh carries a comment stating steps 9 and 10 "are intentionally absent" for exactly this reason.

What changed

Renders now write out/manifests/<env>/<fragment>.yaml, matching the deploy-artifact action. The two nonexistent subcommands are gone — validate-raw-manifests replaced by an explicit guard that names the limitation if rawManifests is ever declared, rather than scoring an unexplained fail. emit-contract gets the deployment and the resolved cluster-context file, located the way CI locates it.

For validation, the script now lifts the applyable objects with emit-apply-bundle and points kubeconform and kustomize build at that bundle. Those objects are real Kubernetes YAML and the bundle ships the kustomization.yaml the previous kustomize build was missing, so both checks become meaningful instead of guaranteed failures.

The baked-in schema-version fallback still read 0.16.0 and the default context digest was two republications behind the digest CI pins; both now match the pipeline.

Verification

Run end-to-end against the current public context in all six repos carrying the script: five fragments render, the apply bundle builds, kustomize build succeeds on it, and artifact-contract.yaml is emitted with a render hash. The only scorecard fail in each run is npm_signatures_verified, caused by the stubbed npm used to skip a global install in this environment, not by the script.

Underlying cause

This script is duplicated across seven repositories, and it had already drifted — agents-ui carried a third distinct context digest. Every defect above was fixed seven times because there is one copy per repo. Worth considering a single shared script or action invoked by each repo, but that is a design change rather than a fix and is left out of this PR.

[github-actions]

Deploy Preview — auth-api

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:9479bc22ae11183c0b68f257d2c1a21455be8c3cff602d3a491ea3ff31d01fe3
Workloads: 1 | Routes: 1 | Gatus entries: 0

Image refs

• auth-api: ghcr.io/jorisjonkers-dev/auth-api/auth-api@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
➖	stateful_policy_declared	not_applicable
➖	raw_manifests_guarded	not_applicable
➖	npm_signatures_verified	not_applicable

⚠️ Escape hatch in use: one or more scorecard checks are not_applicable.

---

Updated by deploy-preview action on push to this PR.