Establish G0-G4 verification architecture

.github/workflows/browser-output-certification.yml

@@ -0,0 +1,111 @@
+name: Browser output certification
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  host:
+    name: ${{ matrix.host }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: windows-x64-chromium
+            runner: windows-latest
+            browser: chromium
+          - host: windows-x64-firefox
+            runner: windows-latest
+            browser: firefox
+          - host: windows-x64-webkit
+            runner: windows-latest
+            browser: webkit
+          - host: linux-x64-chromium
+            runner: ubuntu-24.04
+            browser: chromium
+          - host: linux-x64-firefox
+            runner: ubuntu-24.04
+            browser: firefox
+          - host: linux-x64-webkit
+            runner: ubuntu-24.04
+            browser: webkit
+          - host: macos-arm64-chromium
+            runner: macos-15
+            browser: chromium
+          - host: macos-arm64-firefox
+            runner: macos-15
+            browser: firefox
+          - host: macos-arm64-webkit
+            runner: macos-15
+            browser: webkit
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate certification authority
+        run: pnpm check:browser-output-authority
+      - name: Install Rust toolchain
+        run: rustup toolchain install 1.96.0 --profile minimal
+      - name: Install browser and Linux dependencies
+        if: runner.os == 'Linux'
+        run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
+      - name: Install browser
+        if: runner.os != 'Linux'
+        run: pnpm exec playwright install ${{ matrix.browser }}
+      - name: Execute browser/output host
+        run: pnpm check:browser-output -- --browser=${{ matrix.browser }} --host=${{ matrix.host }} --output=target/browser-output-certification/evidence/${{ matrix.host }}.json --require-clean
+      - name: Upload host evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: browser-output-${{ matrix.host }}-${{ github.sha }}
+          path: |
+            target/browser-output-certification/evidence/${{ matrix.host }}.json
+            target/browser-output-certification/evidence/${{ matrix.host }}.screenshots
+          if-no-files-found: error
+          retention-days: 30
+
+  matrix:
+    name: Aggregate browser/output matrix
+    needs: host
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.13.0
+      - name: Install pnpm
+        run: npm install --global pnpm@11.7.0
+      - name: Install locked dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Validate certification authority
+        run: pnpm check:browser-output-authority
+      - name: Download all host evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: browser-output-*-${{ github.sha }}
+          path: target/browser-output-certification/incoming
+          merge-multiple: true
+      - name: Validate complete matrix
+        run: pnpm check:browser-output-matrix -- --evidence-root=target/browser-output-certification/incoming --output=target/browser-output-certification/browser-output-matrix.json
+      - name: Upload complete matrix
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: browser-output-matrix-${{ github.sha }}
+          path: target/browser-output-certification/browser-output-matrix.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/ci.yml

@@ -78,6 +78,7 @@ jobs:
         env:
           PLIEGO_CSSC: target/debug/pliego-cssc${{ runner.os == 'Windows' && '.exe' || '' }}
           PLIEGO_LOCK_HOLDER: target/debug/pliego-publication-lock-holder${{ runner.os == 'Windows' && '.exe' || '' }}
+          PLIEGOCSS_RUST_TOOLCHAIN: ${{ matrix.toolchain }}
         run: node scripts/check-parallel-determinism.mjs
       - name: Check cross-platform bundle contract
         run: node scripts/check-portability.mjs
@@ -120,6 +121,10 @@ jobs:
           node-version: 22.13.0
       - name: Install pnpm for documentation gates
         run: npm install --global pnpm@11.7.0
+      - name: Install Rust toolchains
+        run: |
+          rustup toolchain install 1.85.0 --profile minimal
+          rustup toolchain install 1.96.0 --profile minimal --component rustfmt
       - name: Verify release profile registry
         run: node scripts/check-release.test.mjs
       - name: Check documentation graph
@@ -128,8 +133,6 @@ jobs:
         run: node scripts/check-brand.mjs
       - name: Check compatibility policy
         run: node scripts/check-compatibility-policy.mjs
-      - name: Install rustfmt
-        run: rustup toolchain install 1.96.0 --profile minimal --component rustfmt
       - name: Check formatting
         run: |
           cargo +1.96.0 fmt --all -- --check
@@ -247,6 +250,12 @@ jobs:
           rustup target add wasm32-unknown-unknown --toolchain 1.96.0
       - name: Install benchmark dependencies
         run: pnpm install --frozen-lockfile
+      - name: Check Benchmark Authority v2
+        run: pnpm check:benchmark-authority
+      - name: Check browser/output certification authority
+        run: pnpm check:browser-output-authority
+      - name: Smoke Benchmark Authority v2 runner
+        run: pnpm check:benchmark-smoke
       - name: Build and validate the PliegoRS-authored website
         run: pnpm check:site
       - name: Validate the Cloudflare public deployment profile

CHANGELOG.md

@@ -8,6 +8,39 @@ pre-1.0 compatibility policy.
 
 ## [Unreleased]
 
+### Changed
+
+- Separate stable breakpoint identity from narrow-to-wide cascade rank. ThemeId
+  and theme-binary formats move to 3, catalog to schema 4, and inspection to
+  schema 3; older generated theme/identity artifacts must be regenerated.
+- Namespace official Cargo targets by complete Rust toolchain/platform identity,
+  including the Rust 1.85 property/LSP gates and Rust 1.86 PliegoRS gate.
+- Re-pin the fail-closed PliegoRS integration contract to current `main` after
+  the G1 native runtime entered the workspace, and replay the complete SSG,
+  route/island bundle, manifest, and browser-payload gate against that revision.
+- Make release-readiness schema 3 the single current promotion authority,
+  fail closed on unconfigured hosted browser lanes, archive superseded status
+  reports, and generate the public documentation catalog from hash-bound
+  Markdown instead of duplicated Rust page data.
+- Introduce the pure `CompileRequest`/`CompileResult` engine boundary with a
+  theme-bound `AnalysisHost`, compiler-owned `PhysicalRulePlanner`, and shared
+  `pcx` frontend. CLI, watch, macros, source scanning, and LSP now reuse that
+  engine; the LSP no longer launches compiler children or writes synthetic
+  source files.
+- Replace the handwritten Gate B comparison with Benchmark Authority schema 2:
+  live `tailwind-latest` 4.3.3, upstream `v3-lts` 3.4.19, frozen 4.3.2 regression,
+  alternating paired samples, direct-process peak memory, raw/gzip/Brotli output,
+  micro/medium/large corpora, a seven-day oracle, and JSON-generated benchmark docs.
+
+### Fixed
+
+- Emit custom media and container breakpoints by numeric cascade rank instead
+  of name-assigned `BreakpointId`; the 52rem/72rem regression is frozen in
+  property tests and Chrome/Edge computed-style gates.
+- Reject empty reversible migration projects with a typed public error instead
+  of indexing an empty inventory, and audit every current Lightning CSS rule
+  variant without a silent wildcard.
+
 ## [0.1.0-rc.2] - 2026-07-21
 
 This candidate supersedes `0.1.0-rc.1` without moving its immutable tag. It is
@@ -16,6 +49,15 @@ compatibility unit.
 
 ### Added
 
+- Browser/output certification v1 against the fresh Tailwind authority lane: 52 computed
+  properties, 1/64-pixel box/text-line geometry bounded to 0.1 CSS px, bounded perceptual screenshots,
+  responsive/hover/focus scenarios, and explicit
+  no-reset/shared-reset contracts.
+- A clean, seven-day, commit/tree-bound 3×3 Playwright matrix for Chromium, Firefox, and WebKit on
+  Windows x64, Linux x64, and macOS ARM64, plus fail-closed aggregation and hashed PNG/JSON evidence.
+  Playwright 1.61.1, pixelmatch 7.2.0, and pngjs 7.0.0 are pinned and attributed. Dirty local
+  Windows x64 and Linux x64 passes are diagnostic; hosted 9/9 acceptance remains pending.
+
 - A complete bilingual public-preview website authored with PliegoRS and
   styled by PliegoCSS, including interactive compiler examples, categorized
   documentation, command search, legal and accessibility pages, GSAP/Lenis

THIRD_PARTY_NOTICES.md

@@ -64,12 +64,41 @@ bundled software dependencies.
 
 ## Benchmark-only software
 
-### Tailwind CSS and CLI 4.3.2
+### Tailwind CSS and CLI benchmark lanes
 
-- Relationship: frozen performance and ergonomics baseline only; not a PliegoCSS runtime/backend
-  dependency.
+- Relationship: performance and ergonomics baselines only; not PliegoCSS runtime/backend
+  dependencies. Benchmark Authority v2 uses current `4.3.3`, upstream `v3-lts` `3.4.19`, and
+  frozen regression control `4.3.2`.
 - License: MIT.
 - Source: https://github.com/tailwindlabs/tailwindcss
-- Locked evidence: `tailwindcss@4.3.2`, `@tailwindcss/cli@4.3.2`, and the complete transitive
-  `pnpm-lock.yaml` graph at SHA-256
-  `c4f9b91705418524bd91178fd417e3b02585dfce613c2a56e6cef25a6c8c1049`.
+- Locked evidence: `tailwindcss@4.3.3`, `@tailwindcss/cli@4.3.3`,
+  `tailwindcss@3.4.19`, `tailwindcss@4.3.2`, `@tailwindcss/cli@4.3.2`, their registry SRI values,
+  and the complete transitive `pnpm-lock.yaml` graph at SHA-256
+  `39f1ccd3f3b3262805d773e92bf8b2d0efc9ac755ba77460a0cb801d5ccea394`.
+
+## Browser-certification software
+
+These packages are test-only tooling for Browser/output certification v1. They do not ship in the
+PliegoCSS compiler or generated CSS.
+
+### Playwright 1.61.1
+
+- Relationship: launches the pinned Chromium, Firefox, and WebKit certification engines.
+- License: Apache-2.0.
+- Source: https://github.com/microsoft/playwright
+- Locked evidence: `playwright@1.61.1`, `playwright-core@1.61.1`, their npm SRI values, and the
+  complete `pnpm-lock.yaml` SHA-256 recorded above.
+
+### pixelmatch 7.2.0
+
+- Relationship: bounded perceptual comparison of captured PNG pixels.
+- License: ISC.
+- Source: https://github.com/mapbox/pixelmatch
+- Locked evidence: `pixelmatch@7.2.0`, its npm SRI, and the complete pnpm lock SHA-256.
+
+### pngjs 7.0.0
+
+- Relationship: deterministic PNG decoding and diff encoding for certification evidence.
+- License: MIT.
+- Source: https://github.com/pngjs/pngjs
+- Locked evidence: `pngjs@7.0.0`, its npm SRI, and the complete pnpm lock SHA-256.

benchmarks/benchmark-authority-v2/micro.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>PliegoCSS benchmark authority micro corpus</title>
+  </head>
+  <body class="min-h-screen bg-canvas font-sans text-ink antialiased">
+    <button
+      class="inline-flex cursor-pointer items-center justify-center gap-2 rounded-lg bg-accent px-4 py-2 text-sm font-semibold text-white shadow-sm transition-colors hover:bg-accent-strong focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-accent disabled:cursor-not-allowed disabled:opacity-50"
+    >
+      Save changes
+    </button>
+  </body>
+</html>