🐛[Fix] Sprint 17 v2 release hardening

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - main
+      - v2
 
 permissions:
   contents: read

404.html

@@ -17,9 +17,9 @@
   </head>
   <body class="page-shell" data-page="notFound">
     <a class="skip-link" href="#main" data-i18n="common.skip">Skip to main content</a>
-    <header class="site-header"><div class="container header-inner"><a class="brand" href="./" aria-label="Secure Tools home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><div class="header-controls"><label class="control-label"><span data-i18n="common.language">Language</span><select class="control" data-language-select><option value="en">English</option><option value="ko">한국어</option><option value="ja">日本語</option><option value="es">Español</option><option value="de">Deutsch</option><option value="fr">Français</option></select></label><label class="control-label"><span data-i18n="common.theme">Theme</span><select class="control" data-theme-select><option value="system" data-i18n="common.themes.system">System</option><option value="light" data-i18n="common.themes.light">Light</option><option value="dark" data-i18n="common.themes.dark">Dark</option></select></label></div></div></header>
+    <header class="site-header"><div class="container header-inner"><a class="brand" href="./" aria-label="Secure Tools home" data-i18n-aria-label="common.aria.home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><div class="header-controls"><label class="control-label"><span data-i18n="common.language">Language</span><select class="control" data-language-select><option value="en">English</option><option value="ko">한국어</option><option value="ja">日本語</option><option value="es">Español</option><option value="de">Deutsch</option><option value="fr">Français</option></select></label><label class="control-label"><span data-i18n="common.theme">Theme</span><select class="control" data-theme-select><option value="system" data-i18n="common.themes.system">System</option><option value="light" data-i18n="common.themes.light">Light</option><option value="dark" data-i18n="common.themes.dark">Dark</option></select></label></div></div></header>
     <main id="main" class="page-main not-found"><div class="container prose"><p class="eyebrow" data-i18n="notFound.eyebrow">404</p><h1 data-i18n="notFound.title">This page is not here.</h1><p data-i18n="notFound.description">The address may be outdated or mistyped.</p><a class="button button--primary" href="./" data-i18n="notFound.action">Return home</a></div></main>
-    <footer class="site-footer"><div class="container footer-inner"><div><a class="brand" href="./" aria-label="Secure Tools home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><p data-i18n="common.footerStatement">Your files stay on your device.</p></div><nav aria-label="Footer navigation"><a href="./#tools" data-i18n="common.nav.tools">Tools</a><a href="./privacy/" data-i18n="common.nav.privacy">Privacy</a><a href="./about/" data-i18n="common.nav.about">About</a><a href="https://github.com/maruson08/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a></nav></div></footer>
+    <footer class="site-footer"><div class="container footer-inner"><div><a class="brand" href="./" aria-label="Secure Tools home" data-i18n-aria-label="common.aria.home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><p data-i18n="common.footerStatement">Your files stay on your device.</p></div><nav aria-label="Footer navigation" data-i18n-aria-label="common.aria.footerNavigation"><a href="./#tools" data-i18n="common.nav.tools">Tools</a><a href="./privacy/" data-i18n="common.nav.privacy">Privacy</a><a href="./about/" data-i18n="common.nav.about">About</a><a href="https://github.com/SecureToolsProject/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a></nav></div></footer>
     <script type="module" src="./js/main.js"></script>
   </body>
 </html>

CHANGELOG.md

@@ -16,6 +16,11 @@
 
 ### Changed
 
+- Hardened v2 promotion gates for all ten production tools, vendored-resource integrity, local-only network invariants, save failure paths, and resource boundaries.
+- Corrected canonical repository links and extended integration CI to `v2` pushes.
+- Narrowed homepage and category privacy copy to production file-content processing and localized shared navigation and summary accessible names across all six interface languages.
+- Added a live v2 promotion QA matrix that keeps blocked browser evidence separate from passing automated checks.
+
 - Removed the standalone planned Rotate PDF card; page rotation remains available as part of PDF Organizer.
 - Moved shared browser image validation and decoding into `tools/shared/image.js` for PDF and Image tools.
 - Promoted Privacy from generic planned placeholders to a production navigation hub for the existing Image and PDF metadata tools, with distinct supported-scope copy in all six locales.

README.md

@@ -2,9 +2,9 @@
 
 Secure Tools is a privacy-first web hub for everyday file utilities. Production tools process file contents locally in the browser instead of uploading them to a server.
 
-The project uses a category-first architecture, a Pull Request/main CI gate, and static GitHub Pages deployment.
+The project uses a category-first architecture, pull-request CI plus `main`/`v2` integration CI gates, and static GitHub Pages deployment.
 
-The v1 baseline is recorded in the [changelog](./CHANGELOG.md) and historical [v1.0.0 release QA checklist](./docs/release-qa.md). Sprint 12 begins the v2 cycle by expanding production tools into the Image category.
+The v1 baseline is recorded in the [changelog](./CHANGELOG.md) and historical [v1.0.0 release QA checklist](./docs/release-qa.md). The live [v2 promotion QA gate](./docs/v2-release-qa.md) records current automated evidence, dependency and repository risks, and the open manual browser matrix.
 
 ## Available tools
 

about/index.html

@@ -20,12 +20,12 @@
     <a class="skip-link" href="#main" data-i18n="common.skip">Skip to main content</a>
     <header class="site-header">
       <div class="container header-inner">
-        <a class="brand" href="../" aria-label="Secure Tools home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a>
-        <nav class="site-nav" aria-label="Primary navigation">
+        <a class="brand" href="../" aria-label="Secure Tools home" data-i18n-aria-label="common.aria.home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a>
+        <nav class="site-nav" aria-label="Primary navigation" data-i18n-aria-label="common.aria.primaryNavigation">
           <a href="../#tools" data-i18n="common.nav.tools">Tools</a>
           <a href="../privacy/" data-i18n="common.nav.privacy">Privacy</a>
           <a href="./" aria-current="page" data-i18n="common.nav.about">About</a>
-          <a href="https://github.com/maruson08/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a>
+          <a href="https://github.com/SecureToolsProject/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a>
         </nav>
         <div class="header-controls">
           <label class="control-label"><span data-i18n="common.language">Language</span><select class="control" data-language-select><option value="en">English</option><option value="ko">한국어</option><option value="ja">日本語</option><option value="es">Español</option><option value="de">Deutsch</option><option value="fr">Français</option></select></label>
@@ -44,7 +44,7 @@ <h2 data-i18n="about.philosophyTitle">Local-first and open</h2>
         <p data-i18n="about.philosophyBody">The project favors static, understandable code and a privacy model that anyone can verify through source and network inspection.</p>
       </article>
     </main>
-    <footer class="site-footer"><div class="container footer-inner"><div><a class="brand" href="../" aria-label="Secure Tools home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><p data-i18n="common.footerStatement">Your files stay on your device.</p></div><nav aria-label="Footer navigation"><a href="../#tools" data-i18n="common.nav.tools">Tools</a><a href="../privacy/" data-i18n="common.nav.privacy">Privacy</a><a href="./" data-i18n="common.nav.about">About</a><a href="https://github.com/maruson08/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a></nav></div></footer>
+    <footer class="site-footer"><div class="container footer-inner"><div><a class="brand" href="../" aria-label="Secure Tools home" data-i18n-aria-label="common.aria.home"><span class="brand-mark" aria-hidden="true"></span><span>Secure Tools</span></a><p data-i18n="common.footerStatement">Your files stay on your device.</p></div><nav aria-label="Footer navigation" data-i18n-aria-label="common.aria.footerNavigation"><a href="../#tools" data-i18n="common.nav.tools">Tools</a><a href="../privacy/" data-i18n="common.nav.privacy">Privacy</a><a href="./" data-i18n="common.nav.about">About</a><a href="https://github.com/SecureToolsProject/Secure_Tools" data-repository-link target="_blank" rel="noreferrer" data-i18n="common.nav.source">Source</a></nav></div></footer>
     <script type="module" src="../js/main.js"></script>
   </body>
 </html>

docs/release-qa.md

@@ -1,15 +1,17 @@
 # v1.0.0 Release QA
 
-This document is the release-candidate gate for Secure Tools v1.0.0. It records completed automated evidence separately from manual browser sign-off. An unchecked item is pending, not implicitly passed.
+> Historical snapshot: this checklist records the Sprint 11 release-candidate state before v1.0.0 was published on 2026-08-24. Its then-pending manual boxes are preserved and are not evidence of later sign-off. Use the [v2 promotion QA gate](./v2-release-qa.md) for the current release decision.
+
+This document was the release-candidate gate for Secure Tools v1.0.0. It records completed automated evidence separately from manual browser sign-off. An unchecked item was pending at the time of the snapshot, not implicitly passed.
 
 ## Current decision
 
 - Automated release gate: passed on 2026-08-20 with `node tests/run-all.mjs` and `git diff --check`.
 - Source-level privacy, security, dependency, license, route, resource, localization, responsive-contract, and accessibility audits: passed.
 - Manual browser matrix: pending.
-- v1.0.0 tag and GitHub release: not created by Sprint 11.
+- At the Sprint 11 snapshot, the v1.0.0 tag and GitHub release had not been created. GitHub now records v1.0.0 as published on 2026-08-24.
 
-The Sprint is eligible for integration after CI passes, but publication of the v1.0.0 tag/release remains blocked until a human completes the manual matrix below. This manual gate does not invalidate the automated Sprint result.
+At the time of this snapshot, the Sprint was eligible for integration after CI, while publication remained blocked pending the manual matrix below. The later publication is historical repository state; this preserved checklist does not infer or reconstruct missing manual evidence.
 
 ## Automated release evidence
 

docs/ux-consistency-audit.md

@@ -81,3 +81,10 @@ Automated checks now enforce:
 - complete six-locale Privacy metadata, category, and scope copy.
 
 Interactive browser QA was retried on 2026-08-26 against a temporary localhost server. The browser runtime terminated before navigation with `windows sandbox failed: helper_unknown_error: apply deny-read ACLs`. Browser QA therefore did **not** pass and automated DOM/CSS checks are not presented as visual verification. Manual review remains open for `/`, `/tools/image/`, `/tools/privacy/`, `/tools/image/metadata/`, and `/tools/pdf/metadata/` at 320, 360, 390, 768, 1024, and 1440 CSS pixels in Light and Dark themes, including all six locales and keyboard focus/activation of the Privacy cards.
+
+
+## Sprint 17 release-readiness follow-up
+
+Sprint 17 localized shared brand, primary-navigation, footer-navigation, category-navigation, and local-processing-summary accessible names across all six interface languages. Homepage proof copy now states the bounded invariant—no production file-content upload—rather than the absolute word “Nothing,” and production PDF/Image category notes no longer mention planned cards that are not present. Static i18n and UX tests enforce these contracts across all 19 production pages.
+
+Interactive browser QA was retried on 2026-08-26 against a temporary localhost server. Browser control failed before navigation with `windows sandbox failed: helper_unknown_error: apply deny-read ACLs`. Visual rendering, responsive interaction, keyboard operation, browser-native save/download, and Network-panel checks remain **BLOCKED**, not passed. The complete open matrix is maintained in [v2 promotion QA](./v2-release-qa.md).