Merge remote-tracking branch 'origin/main' into fix/durable-runtime-auth-blocker-003

scripts/src/m3-io-control-e2e.mjs

@@ -364,6 +364,20 @@ export function checkFrontendNoDirectRuntimeCalls({ appSource, htmlSource = "",
   if (/fetchJson\(["'`](?!\/v1\/m3\/io)/u.test(actionBody) || /\bfetch\(/u.test(actionBody)) {
     issues.push("runM3IoAction must not call any path other than fetchJson(\"/v1/m3/io\")");
   }
+  if (!/if \(!m3ControlCanOperate\(\)\)/u.test(actionBody)) {
+    issues.push("runM3IoAction must fail closed before POST when M3 readiness is blocked");
+  }
+  const readinessBody = functionBody(appSource, "m3ControlCanOperate");
+  for (const [pattern, label] of [
+    [/readiness\?\.status === "ready"/u, "readiness.status=ready"],
+    [/readiness\?\.controlReady === true/u, "readiness.controlReady=true"],
+    [/readiness\?\.sourceKind === "DEV-LIVE"/u, "readiness.sourceKind=DEV-LIVE"],
+    [/readiness\?\.evidenceLevel === "DEV-LIVE"/u, "readiness.evidenceLevel=DEV-LIVE"]
+  ]) {
+    if (!pattern.test(readinessBody)) {
+      issues.push(`m3ControlCanOperate must require ${label}`);
+    }
+  }
   if (!/url\.pathname === "\/v1\/m3\/io"/u.test(artifactPublisherSource)) {
     issues.push("cloud-web artifact server must proxy same-origin /v1/m3/io to cloud-api");
   }
@@ -438,6 +452,9 @@ export function validateM3IoSourceResponseContract(m3Source) {
     /durableStatus:\s*durableStatus\(/u,
     /blockerClassification:\s*redactedBlockerClassification\(/u,
     /persistence:\s*persistenceSummary\(/u,
+    /describeM3IoControlLive/u,
+    /buildM3IoReadiness/u,
+    /controlReady:\s*false/u,
     /frontendBypass:\s*false/u,
     /patchPanelOnlyPropagation:\s*true/u,
     /sourceKind:\s*"DEV-LIVE"/u,