merge: main into homepage-rebuild — adopt the reliability band, drop the Yes Wall

main's #996 replaced the Yes wall with the reliability band: ProofStrip moves
into the dark contrast slot under the logo ribbon and the Yes wall is deleted.
That supersedes this branch's Task 12, so the Yes wall work is dropped rather
than merged.

- page.tsx: ProofStrip (dark) sits directly under LogoRibbon, ahead of
  RuntimeParity/ThreeSteps. YesWall is gone; Promises went with #980 and its
  component no longer exists on main. StackDiagramSection and HomeConceptGrid
  stay unmounted here (they still ship on /langgraph and /ag-ui). Metadata
  keeps HOME_TITLE/HOME_DESCRIPTION.
- landing.css: main's proof-strip block wholesale, including its min-width:0
  fix, which supersedes this branch's repeat(2, minmax(0, 1fr)) from 5b6328b.
  The .yes-wall-* rules and the Task 12 expander are deleted.
- style-contracts.spec.ts: the .yes-wall-row[hidden] contract is removed; the
  rule it guarded no longer exists.
- FinalCTA.tsx: keeps this branch's optional ctaId on primary/secondary and
  captionLink, and honours main's retirement of the promise caption — the
  caption prop stays, but its default is null instead of the old
  "Installation is inert" line, which main's e2e now asserts is absent.
- analytics/events.ts + taxonomy.md: home_production_readiness_expand joins
  home_yes_wall_docs as retired; neither has a firing site any more.
- e2e: the Yes Wall expander test is dropped from home-hero.spec.ts;
  website.spec.ts keeps main's dark-proof-band assertion alongside this
  branch's five-FeatureBlock and H1 assertions.
- HomeFAQ: the branch's telemetry question made a barred absolute claim
  ("Installation is inert") and linked the retired /docs/telemetry library,
  both of which main's public-copy contract now forbids. Replaced with a
  reporting question answered from /privacy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: blove

.github/workflows/ci.yml

@@ -1,3 +1,71 @@
+## 0.0.65 (2026-09-03)
+
+### 🚀 Features
+
+- Mastra runtime Lane B — ag-ui-mastra Node service, proxy map, rt-mastra example, deploy workflow ([#903](https://github.com/cacheplane/angular-agent-framework/pull/903), [#899](https://github.com/cacheplane/angular-agent-framework/issues/899))
+- add operational sidebar control plane ([#921](https://github.com/cacheplane/angular-agent-framework/pull/921))
+- unify docs and cockpit workspace ([#949](https://github.com/cacheplane/angular-agent-framework/pull/949))
+- unify docs and runtime control plane ([#963](https://github.com/cacheplane/angular-agent-framework/pull/963))
+- **ag-ui:** upgrade @ag-ui/* to 0.0.59 and send protocol-standard top-level resume ([#891](https://github.com/cacheplane/angular-agent-framework/pull/891))
+- **ag-ui:** consume the protocol's SUBAGENT_* events and subagentRunId attribution ([#955](https://github.com/cacheplane/angular-agent-framework/pull/955))
+- **cockpit:** per-topic framework adapters in the AG-UI deployment generator ([#894](https://github.com/cacheplane/angular-agent-framework/pull/894))
+- **cockpit:** Microsoft Agent Framework runtime example (cockpit/runtimes) ([#896](https://github.com/cacheplane/angular-agent-framework/pull/896), [#888](https://github.com/cacheplane/angular-agent-framework/issues/888), [#889](https://github.com/cacheplane/angular-agent-framework/issues/889), [#891](https://github.com/cacheplane/angular-agent-framework/issues/891))
+- **cockpit:** AWS Strands runtime example (rt-strands) ([#898](https://github.com/cacheplane/angular-agent-framework/pull/898))
+- **cockpit:** make Run discoverable from Code ([#934](https://github.com/cacheplane/angular-agent-framework/pull/934))
+- **cockpit:** ag-ui subagents demo emits the protocol's SUBAGENT_* events ([#962](https://github.com/cacheplane/angular-agent-framework/pull/962))
+- **e2e-harness:** restore aimock — replay+record wrapper, drift infra, scrub repairs ([#947](https://github.com/cacheplane/angular-agent-framework/pull/947))
+- **e2e-harness:** bucket metadata-hash mismatches as promptChanged in the drift differ ([#951](https://github.com/cacheplane/angular-agent-framework/pull/951))
+- **examples:** ag-ui demo emits the protocol's SUBAGENT_* events ([#964](https://github.com/cacheplane/angular-agent-framework/pull/964))
+- **examples/chat:** /hero route — replayed LangGraph walkthrough with live takeover ([#976](https://github.com/cacheplane/angular-agent-framework/pull/976))
+- **runtimes:** strands subagent delegation demo with standard SUBAGENT_* emission ([#956](https://github.com/cacheplane/angular-agent-framework/pull/956))
+- **runtimes:** maf subagent delegation demo with queue-merged SUBAGENT_* emission ([#957](https://github.com/cacheplane/angular-agent-framework/pull/957))
+- **runtimes:** mastra subagent delegation demo with SUBAGENT_* injection in the bridge ([#958](https://github.com/cacheplane/angular-agent-framework/pull/958))
+- **runtimes:** mastra sub-agent streaming via a public-API stream tee ([#961](https://github.com/cacheplane/angular-agent-framework/pull/961))
+- **runtimes:** stand-down guard so the mastra subagent injector retires ([#971](https://github.com/cacheplane/angular-agent-framework/pull/971))
+- **website:** homepage punch list — hero merge, FAQ copy, FeatureBlock rows everywhere ([#897](https://github.com/cacheplane/angular-agent-framework/pull/897))
+- **website:** homepage lower half — ledgers, numerals, paper, intent-gated toast ([#901](https://github.com/cacheplane/angular-agent-framework/pull/901))
+- **website:** add 'We Measured the Runtime Swap' blog post ([#905](https://github.com/cacheplane/angular-agent-framework/pull/905), [#888](https://github.com/cacheplane/angular-agent-framework/issues/888), [#889](https://github.com/cacheplane/angular-agent-framework/issues/889), [#891](https://github.com/cacheplane/angular-agent-framework/issues/891))
+- **website:** tighten the pricing page ([#908](https://github.com/cacheplane/angular-agent-framework/pull/908))
+- **website:** library pages in the homepage manner ([#914](https://github.com/cacheplane/angular-agent-framework/pull/914))
+- **website:** design-program follow-ups — showcase rails, Angular proof cell, closer order ([#919](https://github.com/cacheplane/angular-agent-framework/pull/919))
+- **website:** align the docs index with the control plane ([#923](https://github.com/cacheplane/angular-agent-framework/pull/923), [#920](https://github.com/cacheplane/angular-agent-framework/issues/920), [#911](https://github.com/cacheplane/angular-agent-framework/issues/911))
+- **website:** ninth arc — solutions and pilot join the design language ([#927](https://github.com/cacheplane/angular-agent-framework/pull/927))
+- **website:** wire the docs -> cockpit handoff for deep-agents and runtimes ([#938](https://github.com/cacheplane/angular-agent-framework/pull/938), [#937](https://github.com/cacheplane/angular-agent-framework/issues/937), [#913](https://github.com/cacheplane/angular-agent-framework/issues/913))
+
+### 🩹 Fixes
+
+- subagent hardening batch — eviction order, args-buffer scoping, field-based lookup, AIMOCK_MODE warning ([#960](https://github.com/cacheplane/angular-agent-framework/pull/960))
+- **ag-ui:** detect protocol-standard RUN_FINISHED interrupt outcomes ([#888](https://github.com/cacheplane/angular-agent-framework/pull/888))
+- **ag-ui:** carry interrupt identity on the resume payload ([#889](https://github.com/cacheplane/angular-agent-framework/pull/889))
+- **ag-ui:** relative imports in subagents topic + deploy boot gate ([#899](https://github.com/cacheplane/angular-agent-framework/pull/899))
+- **ag-ui:** resolve the subagents agent URL against <base href> ([#902](https://github.com/cacheplane/angular-agent-framework/pull/902))
+- **ag-ui:** attributed TOOL_CALL_START links the child message's toolCallIds so cards draw the call ([#965](https://github.com/cacheplane/angular-agent-framework/pull/965))
+- **ci:** unbreak main — drop verify assertions for the removed pricing matrix ([#915](https://github.com/cacheplane/angular-agent-framework/pull/915), [#908](https://github.com/cacheplane/angular-agent-framework/issues/908))
+- **ci:** accept branded AG-UI compatibility marker ([#930](https://github.com/cacheplane/angular-agent-framework/pull/930))
+- **ci:** stop fanning out the whole cockpit e2e matrix for unrelated changes ([#939](https://github.com/cacheplane/angular-agent-framework/pull/939), [#932](https://github.com/cacheplane/angular-agent-framework/issues/932))
+- **ci:** bump scorecard-action to v2.4.4 so the image pulls again ([#940](https://github.com/cacheplane/angular-agent-framework/pull/940), [#367732848534](https://github.com/cacheplane/angular-agent-framework/issues/367732848534))
+- **ci:** compare requirements.txt drift against git, not a scratch export ([#967](https://github.com/cacheplane/angular-agent-framework/pull/967), [#966](https://github.com/cacheplane/angular-agent-framework/issues/966))
+- **ci:** give the Website Vercel build its growth form policy ([#981](https://github.com/cacheplane/angular-agent-framework/pull/981), [#968](https://github.com/cacheplane/angular-agent-framework/issues/968))
+- **ci:** scope vercel promote to the team that owns the deployment ([#982](https://github.com/cacheplane/angular-agent-framework/pull/982), [#963](https://github.com/cacheplane/angular-agent-framework/issues/963), [#945](https://github.com/cacheplane/angular-agent-framework/issues/945))
+- **ci:** open the protected immutable cockpit preview with its own automation bypass ([#984](https://github.com/cacheplane/angular-agent-framework/pull/984), [#983](https://github.com/cacheplane/angular-agent-framework/issues/983), [#974](https://github.com/cacheplane/angular-agent-framework/issues/974))
+- **cockpit:** teach the cockpit the runtimes product ([#910](https://github.com/cacheplane/angular-agent-framework/pull/910))
+- **cockpit:** point docsPath at docs pages that actually exist ([#918](https://github.com/cacheplane/angular-agent-framework/pull/918))
+- **cockpit:** accept the platform slash collapse for the consecutive-slash raw canary ([#987](https://github.com/cacheplane/angular-agent-framework/pull/987))
+- **deployments:** regenerate ag-ui-dev artifacts after the --no-dev re-export ([#970](https://github.com/cacheplane/angular-agent-framework/pull/970), [#967](https://github.com/cacheplane/angular-agent-framework/issues/967), [#963](https://github.com/cacheplane/angular-agent-framework/issues/963))
+- **examples:** sync requirements.txt with uv.lock; guard drift in CI ([#966](https://github.com/cacheplane/angular-agent-framework/pull/966), [#964](https://github.com/cacheplane/angular-agent-framework/issues/964))
+- **examples/chat:** keep reading pauses in the hero walkthrough under reduced motion ([#979](https://github.com/cacheplane/angular-agent-framework/pull/979))
+- **langgraph:** harden subagent attribution — ladder tests, empty-description guard, nested-delegation streams ([#945](https://github.com/cacheplane/angular-agent-framework/pull/945))
+- **lifecycle:** own enrichment provenance in code; **mailbox-poller:** drop numeric separators ([#985](https://github.com/cacheplane/angular-agent-framework/pull/985))
+- **website:** repair and redesign the docs adapter picker ([#911](https://github.com/cacheplane/angular-agent-framework/pull/911), [#892](https://github.com/cacheplane/angular-agent-framework/issues/892))
+- **website:** give library-neutral docs pages an honest control plane ([#920](https://github.com/cacheplane/angular-agent-framework/pull/920), [#892](https://github.com/cacheplane/angular-agent-framework/issues/892))
+- **website:** final-review fix batch ([#922](https://github.com/cacheplane/angular-agent-framework/pull/922))
+- **website:** restore padding on Shiki code blocks ([#924](https://github.com/cacheplane/angular-agent-framework/pull/924), [#863](https://github.com/cacheplane/angular-agent-framework/issues/863), [#926](https://github.com/cacheplane/angular-agent-framework/issues/926))
+- **website:** close the docs shell's nav-height and column-measure defects ([#942](https://github.com/cacheplane/angular-agent-framework/pull/942), [#932](https://github.com/cacheplane/angular-agent-framework/issues/932))
+- **website:** legible diagram text on phones — 600px floor + scroll shadows ([#953](https://github.com/cacheplane/angular-agent-framework/pull/953))
+- **website:** production-smoke spec must not use import.meta.url ([#973](https://github.com/cacheplane/angular-agent-framework/pull/973), [#963](https://github.com/cacheplane/angular-agent-framework/issues/963))
+- **website:** keep the post-promotion e2e run off the local fixture runtime ([#983](https://github.com/cacheplane/angular-agent-framework/pull/983), [#982](https://github.com/cacheplane/angular-agent-framework/issues/982))
+- **workspace:** keep utility panel focus when the drawer opens in one commit ([#972](https://github.com/cacheplane/angular-agent-framework/pull/972))
+
 ## 0.0.64 (2026-08-31)
 
 ### 🚀 Features

CHANGELOG.md

@@ -195,6 +195,32 @@ branch protection and has no rulesets, so the unprivileged
 `GET /repos/{owner}/{repo}/rules/branches/main` endpoint returns `[]` and is
 not an alternative.
 
+### PR-side deploy verification
+
+Two lanes run the deploy job's verification on pull requests against real
+Vercel previews, so deploy-only failures surface before merge:
+
+- **Website — e2e (deployed preview)** builds and deploys the Website and
+  the examples as previews under deterministic aliases
+  (`threadplane-pr-<n>-cacheplane.vercel.app` and
+  `threadplane-examples-pr-<n>-cacheplane.vercel.app`; `mq-<sha8>` for
+  merge-queue candidates) and runs the ordinary suite against the Website
+  alias. The runtime iframe loads because the examples are assembled with
+  the Website alias in their parent-origin policy and Playwright seeds the
+  examples origin's bypass cookie (`apps/website/e2e/runtime-bypass-setup.ts`).
+  A later push re-points both aliases; the deployments behind them are kept.
+- **Cockpit — immutable preview smoke** deploys a throwaway cockpit preview,
+  runs the exhaustive redirect smoke against it, and removes it.
+
+Both need repository secrets and therefore skip on fork PRs; the required
+gate only demands them when they were eligible to run. Each Vercel project
+has its own Protection Bypass for Automation secret:
+`VERCEL_AUTOMATION_BYPASS_SECRET` (Website),
+`VERCEL_EXAMPLES_AUTOMATION_BYPASS_SECRET`, and
+`VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRET`. A secret added while a run is in
+flight does not reach that run; re-run after provisioning. Never pass
+`--skip-domain` to a preview deploy; Vercel requires it to accompany `--prod`.
+
 ## Code review
 
 Every PR gets a genuine advisory AI code review

CONTRIBUTING.md

@@ -312,7 +312,7 @@ describe('redirect deploy smoke contract', () => {
     expect(sleep).toHaveBeenCalledTimes(1);
   });
 
-  it('identifies the Vercel Raw Path prerequisite when a raw canary is normalized', async () => {
+  it('identifies the raw-path rejection route when a raw canary is normalized', async () => {
     const cases = buildRedirectSmokeCases('production');
     const requestImpl = vi.fn(async (request: RedirectSmokeRequest) => {
       const smokeCase = cases.find(
@@ -329,7 +329,170 @@ describe('redirect deploy smoke contract', () => {
         mode: 'production',
         requestImpl,
       })
-    ).rejects.toThrow(/WAF Raw Path prerequisite/);
+    ).rejects.toThrow(/vercel\.cockpit\.json/);
+  });
+
+  it('accepts only the platform same-origin slash collapse for a consecutive-slash probe', async () => {
+    // Vercel's CDN collapses consecutive slashes and answers 308 to the
+    // single-slash path on the same origin before any route, rewrite, or
+    // function runs, so that probe can never reach the 404 route. The only
+    // acceptable non-404 answer is that exact normalization; a redirect off
+    // the deployment from a malformed path is still a contract failure.
+    const cases = buildRedirectSmokeCases('preview');
+    const slashCase = cases.find(
+      (smokeCase) => smokeCase.raw && smokeCase.path.includes('//')
+    );
+    const dotCase = cases.find(
+      (smokeCase) => smokeCase.raw && smokeCase.path.includes('/./')
+    );
+    if (!slashCase || !dotCase) throw new Error('Expected raw canaries');
+    expect(slashCase.platformNormalizedPath).toBe(
+      '/langgraph/core-capabilities/streaming/overview/python'
+    );
+    expect(dotCase.platformNormalizedPath).toBeUndefined();
+
+    const impl = (answer: (request: RedirectSmokeRequest) => RedirectSmokeResponse | null) =>
+      vi.fn(async (request: RedirectSmokeRequest) =>
+        answer(request) ?? responseFor(request, cases)
+      );
+
+    await expect(
+      runDeploySmoke({
+        url: previewUrl,
+        mode: 'preview',
+        requestImpl: impl((request) =>
+          request.path === slashCase.path
+            ? {
+                status: 308,
+                // The platform answers with a relative Location.
+                headers: {
+                  location:
+                    '/langgraph/core-capabilities/streaming/overview/python',
+                },
+              }
+            : null
+        ),
+      })
+    ).resolves.toBe(`pass:preview:${previewUrl}:${cases.length}`);
+
+    await expect(
+      runDeploySmoke({
+        url: previewUrl,
+        mode: 'preview',
+        requestImpl: impl((request) =>
+          request.path === slashCase.path
+            ? {
+                status: 308,
+                headers: {
+                  location: `${previewUrl}/langgraph/core-capabilities/streaming/overview/python`,
+                },
+              }
+            : null
+        ),
+      })
+    ).resolves.toBe(`pass:preview:${previewUrl}:${cases.length}`);
+
+    await expect(
+      runDeploySmoke({
+        url: previewUrl,
+        mode: 'preview',
+        requestImpl: impl((request) =>
+          request.path === slashCase.path
+            ? {
+                status: 308,
+                headers: {
+                  location:
+                    'https://threadplane.ai/docs/langgraph/guides/streaming?mode=run',
+                },
+              }
+            : null
+        ),
+      })
+    ).rejects.toThrow(/raw malformed 1.*expected 404, received 308/);
+
+    await expect(
+      runDeploySmoke({
+        url: previewUrl,
+        mode: 'preview',
+        requestImpl: impl((request) =>
+          request.path === dotCase.path
+            ? {
+                status: 308,
+                headers: {
+                  location: `${previewUrl}/langgraph/core-capabilities/streaming/overview/python`,
+                },
+              }
+            : null
+        ),
+      })
+    ).rejects.toThrow(/expected 404, received 308/);
+  });
+
+  it('sends the automation bypass on every probe only when a secret is supplied', async () => {
+    // Vercel deployment protection answers every path on an unaliased
+    // deployment with 302 -> vercel.com/sso-api, so the immutable cockpit
+    // artifact can only be verified with the project's automation bypass.
+    const cases = buildRedirectSmokeCases('preview');
+    const withSecret = vi.fn(async (request: RedirectSmokeRequest) => {
+      const { 'x-vercel-protection-bypass': bypass, ...rest } =
+        request.headers ?? {};
+      if (bypass !== 'cockpit-bypass-sentinel') {
+        throw new Error(`Missing bypass on ${request.path}`);
+      }
+      return responseFor(
+        { ...request, headers: Object.keys(rest).length ? rest : undefined },
+        cases
+      );
+    });
+
+    await expect(
+      runDeploySmoke({
+        url: previewUrl,
+        mode: 'preview',
+        requestImpl: withSecret,
+        bypassSecret: 'cockpit-bypass-sentinel',
+      })
+    ).resolves.toBe(`pass:preview:${previewUrl}:${cases.length}`);
+    expect(withSecret).toHaveBeenCalledTimes(cases.length);
+    expect(withSecret).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: '/langgraph/core-capabilities/streaming/overview/python',
+        headers: expect.objectContaining({
+          'x-forwarded-host': 'attacker.test',
+          'x-vercel-protection-bypass': 'cockpit-bypass-sentinel',
+        }),
+      })
+    );
+
+    const withoutSecret = vi.fn(async (request: RedirectSmokeRequest) =>
+      responseFor(request, cases)
+    );
+    await runDeploySmoke({
+      url: previewUrl,
+      mode: 'preview',
+      requestImpl: withoutSecret,
+    });
+    for (const [request] of withoutSecret.mock.calls) {
+      expect(request.headers ?? {}).not.toHaveProperty(
+        'x-vercel-protection-bypass'
+      );
+    }
+  });
+
+  it('names Vercel deployment protection when a probe lands on the SSO redirect', async () => {
+    const requestImpl = vi.fn(async () => ({
+      status: 302,
+      headers: {
+        location:
+          'https://vercel.com/sso-api?url=https%3A%2F%2Fimmutable-preview.vercel.app%2F&nonce=abc',
+      },
+    }));
+
+    await expect(
+      runDeploySmoke({ url: previewUrl, mode: 'preview', requestImpl })
+    ).rejects.toThrow(
+      /expected 308, received 302.*deployment protection.*automation bypass/i
+    );
   });
 
   it('formats dry-run output with the selected mode and case count', async () => {