IB-1: freeze security and 11-language foundation

[xrpbanks]

Summary

• freezes the Identity Bridge v1 trust, origin, TTL, session and minimal-claims boundaries
• adds the canonical eleven-locale registry: English, Simplified Chinese, Hindi, Spanish, Arabic, French, Bengali, Portuguese, Indonesian, Urdu and Dutch
• synchronizes exact deployable registry copies for backend, frontend and the WordPress companion plugin
• adds locale resolution with English fallback and RTL handling for Arabic and Urdu
• packages the WordPress locale registry in Identity Bridge 0.3.0
• adds a historical-image localization contract: the original remains immutable and only translated text, locale characters, text fit and separately approved factual details may differ
• adds CI drift, resolver, packaging and preservation-policy tests

Naming correction

• replaces accidental Gallery Token / gallery-token identifiers introduced by this PR without changing runtime behavior
• uses calorieapp.locale-registry for the shared CalorieApp and Identity Bridge locale registry
• uses calorietoken.asset-localization for the historical-image localization policy
• keeps all four runtime locale-registry copies byte-identical
• adds two assertions that freeze both canonical identifiers against regression

Review follow-up

• separates the English fallback statement from the Arabic and Urdu RTL statement
• validates every WordPress locale entry before runtime use, including tags, directions, aliases, source locale and fallback locale
• falls back safely to English LTR when a registry is truncated or contains mixed malformed entries
• adds a PHP regression test for malformed-registry fallback and recovery
• resolves both review threads after exact-head CI passed

Safety boundaries

• no login endpoint, callback route, session behavior, live configuration or database schema changes
• no WordPress page, live plugin, deployment, public copy, historical image or site styling changes
• no automatic translation publishing; localized output still requires preview, review and explicit GO
• personal profile fields remain disabled by default pending a separate consent/purpose contract

Verification

• GitHub CI run 106 on exact head cdf171c: all four required jobs passed
  • Repository boundary
  • WordPress plugin release check, including the malformed-registry regression
  • Backend tests (Python 3.11)
  • Frontend lint and build (Node.js 20)
• current targeted local review-fix checks: contract synchronization, 10 Python contract/release tests, legal-boundary and whitespace checks passed
• earlier targeted naming-correction checks: 4 backend locale tests and 2 Node locale tests passed
• PHP was unavailable locally; the exact-head WordPress plugin release check passed in GitHub CI
• the full local suite was not duplicated because mandatory GitHub CI validated the exact current head

[Copilot]

Pull request overview

Introduces a frozen v1 Identity Bridge contract set (security + locale registry) and synchronizes deployable, byte-identical locale registry copies across backend, frontend, and the WordPress companion plugin. Adds locale resolution with English fallback and RTL support for Arabic and Urdu, plus CI/tests to prevent drift and enforce preservation/localization boundaries.

Changes:

• Added versioned contract sources under contracts/ (Identity Bridge v1 + localization policy) and tooling/tests to validate and synchronize runtime copies.
• Added shared locale registry copies to backend/frontend/WordPress plugin and implemented locale resolution + direction helpers in each runtime.
• Updated CI and WordPress plugin release packaging/tests to include and validate the registry artifacts.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/ci.yml	Adds contract validation + locale registry tests to CI.
README.md	Links to the new versioned contract documentation locations.
backend/app/data/locales.json	Adds backend deployable locale registry copy.
backend/app/locales.py	Implements backend locale resolution + direction helpers.
backend/tests/test_locales.py	Tests backend locale membership, resolution, fallback, and RTL set.
contracts/identity-bridge/v1/README.md	Documents v1 identity bridge and locale contract boundaries.
contracts/identity-bridge/v1/locales.json	Adds canonical v1 locale registry source of truth.
contracts/identity-bridge/v1/locales.schema.json	Defines JSON schema for the locale registry contract.
contracts/identity-bridge/v1/security.json	Adds canonical v1 security contract (TTLs, origin policy, claims, etc.).
contracts/localization/v1/README.md	Documents historical-image localization invariants and workflow.
contracts/localization/v1/asset-localization.json	Adds localization policy contract for historical assets.
contracts/localization/v1/asset-variants.schema.json	Adds schema for localized-asset variant manifests.
frontend/config/locales.json	Adds frontend deployable locale registry copy.
frontend/lib/locales.ts	Implements frontend locale resolution + direction helper using registry.
tools/build_wordpress_plugin_release.py	Ensures plugin release packaging includes config JSON files.
tools/sync_identity_contracts.py	Adds tool to validate/synchronize runtime contract copies and reject drift.
tools/tests/identity_locales.test.mjs	Validates canonical registry and byte-identical runtime copies (Node).
tools/tests/test_build_wordpress_plugin_release.py	Extends release reproducibility test to include locales.json.
tools/tests/test_identity_contracts.py	Validates contracts sync and security TTL parity with runtime defaults.
tools/tests/test_localization_contracts.py	Validates localization contract invariants and shared locale usage.
tools/tests/wordpress_locale_registry.test.php	Adds PHP test to validate WP locale registry resolution + direction.
wordpress-plugins/calorieapp-identity-bridge/README.md	Updates plugin documentation for v0.3.0 locale registry support.
wordpress-plugins/calorieapp-identity-bridge/calorieapp-identity-bridge.php	Bumps plugin version constant/header to 0.3.0.
wordpress-plugins/calorieapp-identity-bridge/config/locales.json	Adds WordPress deployable locale registry copy.
wordpress-plugins/calorieapp-identity-bridge/includes/class-calorieapp-identity-bridge-integrated-login.php	Updates embedded asset version default to 0.3.0.
wordpress-plugins/calorieapp-identity-bridge/includes/class-calorieapp-identity-bridge-locale-registry.php	Adds WP locale registry loader + resolver + direction helper.
wordpress-plugins/calorieapp-identity-bridge/includes/class-calorieapp-identity-bridge.php	Requires the new locale registry class in the plugin bootstrap.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.