From 2c2dfdf8e263617fca3646c3233dd217abf7ef2f Mon Sep 17 00:00:00 2001
From: Michel Paulissen <862400+MichelPaulissen@users.noreply.github.com>
Date: Sat, 4 Jul 2026 15:02:47 +0200
Subject: [PATCH] Sync public scripts to 8ac7413

---
 scripts/acceptance-doc-contract-smoke.js | 31 +++++++++++++++++++++++-
 scripts/acceptance-private.sh            |  1 +
 scripts/cli-first-contract-smoke.js      | 15 ++++++++++++
 scripts/docs-smoke.js                    |  1 +
 4 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/scripts/acceptance-doc-contract-smoke.js b/scripts/acceptance-doc-contract-smoke.js
index 5c3fef0..cf71fda 100755
--- a/scripts/acceptance-doc-contract-smoke.js
+++ b/scripts/acceptance-doc-contract-smoke.js
@@ -45,6 +45,7 @@ function assertNoOpenCriteria(source, name) {
 const phase2 = read("acceptance_criteria_phase2.md");
 const base = read("acceptance_criteria.md");
 const cliFirst = read("cli_acceptance_criteria.md");
+const website = read("website_mvp_inventory.md");
 const docsSmoke = read("scripts/docs-smoke.js");
 const releaseBlockerSmoke = read("scripts/release-blocker-smoke.js");
 const publicAcceptance = read("scripts/acceptance-public.sh");
@@ -82,7 +83,35 @@ for (const [source, name] of [
   );
 }
 
-for (const file of ["MVP.md", "acceptance_criteria.md", "acceptance_criteria_phase2.md", "cli_acceptance_criteria.md"]) {
+assertEveryCriterionHasStatus(website, "website_mvp_inventory.md");
+assert.match(
+  website,
+  /private hosted website addendum to `acceptance_criteria\.md`, `acceptance_criteria_phase2\.md`, and `cli_acceptance_criteria\.md`/,
+  "website acceptance criteria must declare itself as the private hosted website addendum"
+);
+assert.match(
+  website,
+  /barebones functional HTML with no CSS/,
+  "website acceptance criteria must keep the MVP website barebones with no CSS"
+);
+assert.match(
+  website,
+  /Billing is not part of the MVP[\s\S]*Design-document references to billing, paid plans, or plan flags are future metadata placeholders; they do not require MVP website routes/,
+  "website acceptance criteria must keep billing and paid-plan placeholders outside MVP website scope"
+);
+assert.match(
+  website,
+  /- \[ \] \*\*Open:\*\* The private hosted website acceptance gate exists and exercises the barebones website through `disasmer\.michelpaulissen\.com`/,
+  "website acceptance criteria must leave the private website deployment gate explicit and open"
+);
+
+for (const file of [
+  "MVP.md",
+  "acceptance_criteria.md",
+  "acceptance_criteria_phase2.md",
+  "cli_acceptance_criteria.md",
+  "website_mvp_inventory.md",
+]) {
   assert(
     docsSmoke.includes(`"${file}"`),
     `docs smoke must include ${file} as user-facing acceptance context`
diff --git a/scripts/acceptance-private.sh b/scripts/acceptance-private.sh
index 8f5bdc0..5bae846 100755
--- a/scripts/acceptance-private.sh
+++ b/scripts/acceptance-private.sh
@@ -17,6 +17,7 @@ node scripts/tenant-isolation-contract-smoke.js
 node scripts/cli-error-exit-smoke.js
 scripts/release-source-scan.sh
 cargo test --manifest-path private/hosted-policy/Cargo.toml
+node private/hosted-policy/scripts/hosted-signup-contract-smoke.js
 node private/hosted-policy/scripts/prepare-public-release-dryrun-deployment.js
 node private/hosted-policy/scripts/hosted-deployment-smoke.js
 node private/hosted-policy/scripts/hosted-community-smoke.js
diff --git a/scripts/cli-first-contract-smoke.js b/scripts/cli-first-contract-smoke.js
index 50f1236..2885c9d 100644
--- a/scripts/cli-first-contract-smoke.js
+++ b/scripts/cli-first-contract-smoke.js
@@ -66,6 +66,21 @@ expect(
   "billing plan flags are placeholders",
   /Design-document references to billing, paid plans, or plan flags are future metadata placeholders; they do not require MVP CLI commands, coordinator routes, schemas, migrations, website controls, or service logic/
 );
+expect(
+  criteria,
+  "hosted signup remains private Authentik-backed flow",
+  /Hosted account creation is available only through the private hosted identity flow, backed by Authentik[\s\S]*first-login account\/project creation stays inside/
+);
+expect(
+  criteria,
+  "hosted signup provider and password policy criteria",
+  /approved external identity-provider requirement[\s\S]*disasmer_native_password_signup_allowed: false/
+);
+expect(
+  criteria,
+  "hosted signup sanitized failure criteria",
+  /Signup failures do not disclose moderation, abuse-scoring, or allow\/deny internals[\s\S]*stripping issuer, allowlist, abuse-score, moderation-note, and provider-secret details/
+);
 
 const lines = criterionLines(criteria);
 assert(lines.length > 0, "CLI-first criteria must contain criteria lines");
diff --git a/scripts/docs-smoke.js b/scripts/docs-smoke.js
index a7665a5..ce262bf 100644
--- a/scripts/docs-smoke.js
+++ b/scripts/docs-smoke.js
@@ -20,6 +20,7 @@ const userFacingDocs = [
   "acceptance_criteria.md",
   "acceptance_criteria_phase2.md",
   "cli_acceptance_criteria.md",
+  "website_mvp_inventory.md",
 ].map((file) => [file, fs.readFileSync(path.join(repo, file), "utf8")]);
 const publicAcceptance = fs.readFileSync(
   path.join(repo, "scripts/acceptance-public.sh"),