feat(security): enforce pragmatic domain-level network boundaries via static ESLint rules

[google-labs-jules]

Pragmatic Domain-Level Boundaries

This PR implements compile-time/lint-time restriction of client-side network egress paths in core simulation domains to enforce the offline-first zero-trust guarantee.

1. Key Implementations

• eslint.config.js Update: Added a dedicated rule block targeting src/app/domain/**/*.ts (excluding update infrastructure which is outside /domain).
  • Restricted Globals (no-restricted-globals): Blocks usage of raw global network clients:
    • fetch
    • XMLHttpRequest
    • WebSocket
    • EventSource
  • Restricted Properties (no-restricted-properties): Blocks access via namespaces or browser properties:
    • window.fetch / globalThis.fetch
    • window.XMLHttpRequest / globalThis.XMLHttpRequest
    • navigator.sendBeacon (matches any property named sendBeacon)
  • Restricted Imports (no-restricted-imports): Blocks importing @angular/common/http and @angular/common/http/*.
  • Integrated with Specific Sub-Domain Blocks: Explicitly merged @angular/common/http restrictions into the existing more specific nested domain blocks (e.g., study-builder and schema-management) to prevent nested rules overriding/bypassing these global checks.

2. Validation & Verification

• Violation Detection Verified: Introduced explicit violations in /src/app/domain/shared/statistical/largest-remainder.ts to test each restricted global, property, and import. ESLint successfully detected all of them and threw immediate descriptive errors.
• Infrastructure Exemption Verified: Checked src/app/core/services/update-notification.service.ts which successfully utilizes fetch to query for PWA update manifests. Since it lies outside the src/app/domain/ directory, it is exempt from the restrictions and requires absolutely zero inline ESLint override comments (e.g. /* eslint-disable */).
• Standard Checks Green: All unit tests (822+ tests) and repository-wide checks (markdown link checks, duplicate code check, ADR check) pass successfully.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	equipose	e40f611	Commit Preview URL Branch Preview URL	Aug 11 2026, 09:42 PM

[google-labs-jules]

[CI/CD Fix]

We've resolved the documentation sync failure by making the following improvements:

1. Mapped Domain-wide Boundaries: The ESLint boundaries diagram generation script (scripts/sync-architecture.mjs) was updated to correctly map the new domain-wide network restriction src/app/domain/**/*.ts to a DOMAIN node representing domain/**/*.ts.
2. Defensive Mermaid Generation: Avoided generating malformed Mermaid lines/edges when a source node is empty or unmapped. It now only appends the edge if sourceNode is not empty.
3. Synchronized Documentation: Regenerated the docs/reference/ARCHITECTURE_REFERENCE.md file to match the updated diagram logic.