feat: position Ideascape as a security validation lab

[Bots]

Summary

• Repositions every public and authenticated Ideascape route as a security-validation product built around explicit threats, bounded controls, and reproducible proof.
• Removes generic community, neighbor, campaign, cooperative, commons, crowdfunding, and broad idea-incubation positioning from rendered product copy and deterministic catalog content.
• Renames the six rendered catalog categories as security domains while preserving stable internal slugs and existing URLs.
• Keeps all 27 deterministic records complete with a threat scenario, control boundary, and proof requirement.
• Requires 40–500 character threat, control, and proof fields for new private drafts at both browser and database boundaries.
• Prevents authenticated clients from self-publishing or editing lifecycle state outside the private draft workflow.
• Prevents authors from deleting published briefs or mutating their published media through direct clients.
• Preserves the established meaning of existing private intent values instead of silently reinterpreting stored responses.
• Presents those values as private interest—not security capability, evidence contribution, or authorization—in both UI and documentation.
• Limits copy migration updates to an exact, fail-closed manifest of 27 deterministic UUID/slug pairs and prevents repeated migration runs from churning record timestamps.
• Preserves non-seed private briefs, media, validation options, and timestamps even when they share the canonical seed author.
• Reframes validation questions, aggregate evidence, profiles, exercises, and administrator operations around scoped security review.
• Adds regression coverage for prohibited positioning, database-enforced security cases, draft-only author writes, and direct-client bypass attempts.
• Updates product metadata, README, plan, and project status to match the security-first operating model.

Security and privacy boundaries

• Individual validation intent remains private, reversible, and semantically unchanged.
• Only aggregate validation counts remain public.
• Review signals grant no production access, deployment authority, custody, payment, or commitment.
• Existing authentication, RLS, safe return-path, and aggregate-only RPC behavior remains intact.
• Authors can create and update only complete private drafts; they cannot self-publish through a direct Supabase client.
• Legacy category and brief slugs remain internal compatibility identifiers only; rendered labels and content are security-first.
• The positioning migration does not modify unrelated user-authored briefs, media descriptions, validation options, or profiles.

Verification

• Frontend tests: 195/195
• Database tests: 244/244 after a clean local reset
• TypeScript typecheck
• Biome lint
• Biome formatting check
• Production build
• Supabase schema lint
• Dependency audit: 0 vulnerabilities
• git diff --cached --check
• Added-line security scan: no secrets, eval/exec, unsafe HTML, SQL interpolation, or debug logging
• Database state: 27/27 complete deterministic security cases
• Database copy audit: zero prohibited deterministic records
• Migration replay: private user data preserved and all 27 deterministic timestamps unchanged
• Canonical-owner upgrade fixture: non-seed private brief, media, option, and timestamp preserved
• Timestamp preservation uses an explicit historical value rather than transaction-stable now()
• Behavioral negative case: a mismatched deterministic UUID/slug pair is rejected with a check violation
• Original private intent labels and meanings match across UI and documentation
• Residual “Resources would fund” catalog copy: 0 records
• Desktop dark-mode visual QA
• Desktop light-mode visual QA
• 390px full-page mobile visual QA
• Independent exact-checksum staged-diff review

Review artifact

Staged diff SHA-256: ece38a6668fc14acdaaedc425375b406796011054ddf8ca380412a612486c7ad

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ideascape	Ready	Preview	Aug 11, 2026 5:43pm