Fix fail-closed G.A.T.E. validation for live deploy receipts

[Copilot]

Canonical issue

This patch closes the fail-closed validation gap in the Studio G.A.T.E. flow: a caller could force a real Zero-Sim verdict without evidence and claim a live deploy receipt without a verified https:// hostname.

Outcome

The Studio deploy gate now holds or rejects invalid live claims unless the evidence is real and the presented URL passes the verified live-receipt bar. The user flow remains the same — Attempt deploy, evaluate G.A.T.E., and render a visible decision chip — but the UI no longer overclaims success on absent or malformed receipts.

Scope

• Included:
  • Hardened assessZeroSim so a fabricated real verdict is downgraded to unverified when evidence is missing.
  • Enforced fail-closed behavior for malformed live URLs and empty/weak evidence before a deploy can be marked live.
  • Guarded transition evaluation against missing authority/transition data to avoid bypass or null-driven behavior.
  • Added a regression test covering the invented-live-proof case.
• Explicitly excluded:
  • No product flow changes beyond the deployment gate.
  • No Vercel or production deployment mutations.
  • No unrelated UI or backend behavior changes.

Risk

• Risk level: low
• Failure mode: a malformed or incomplete deploy attempt may be held rather than incorrectly marked live.
• Rollback: revert the apps/web/src/lib/gate-transition.ts validation change and the corresponding regression test.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests — cd /home/runner/work/EventRelay/EventRelay/apps/web && npm test -- --run src/lib/__tests__/gate-transition.test.ts src/lib/__tests__/studio-pipeline-status.test.ts on d556b5779ea34270a390eb8e09869543c82335db
• Required CI — CodeQL Security Scan (javascript): 0 alerts on d556b5779ea34270a390eb8e09869543c82335db
• Review threads resolved — no review comments found for the patch on d556b5779ea34270a390eb8e09869543c82335db

Production evidence

Not applicable. This patch changes client-side validation logic only; it does not create or claim a new Vercel preview or production deployment.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:53pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 110d958a-737b-44f0-b1ea-2c6edec34b6b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d556b57.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format