From b5d41443e01130ee6553eaa790f03770145b8313 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robson=20J=C3=BAnior?= <robson.ga.junior@gmail.com>
Date: Tue, 28 Jul 2026 14:48:36 -0300
Subject: [PATCH] docs(webkit): refresh GOVERNANCE_IMPLEMENTATION for
 release-please and the current CI pipeline

The doc (shipped to npm via files: docs) still described the semantic-release/.releaserc mechanism deleted by #798 and an 8-job CI. Rewritten against the current tree: publish-workflow d.ts generation, 12-job governance pipeline with main-only triggers, plain pnpm audit, current scripts/hooks/config locations, and a historical release-automation migration note.
---
 .../webkit/docs/GOVERNANCE_IMPLEMENTATION.md  | 406 ++++++++++--------
 1 file changed, 226 insertions(+), 180 deletions(-)

diff --git a/packages/webkit/docs/GOVERNANCE_IMPLEMENTATION.md b/packages/webkit/docs/GOVERNANCE_IMPLEMENTATION.md
index bcef0b708..953791c36 100644
--- a/packages/webkit/docs/GOVERNANCE_IMPLEMENTATION.md
+++ b/packages/webkit/docs/GOVERNANCE_IMPLEMENTATION.md
@@ -1,15 +1,17 @@
 # Governance Pipeline Implementation
 
-**Date:** 2026-04-13
 **Package:** @aziontech/webkit
 **Framework:** Vue 3 + TypeScript
 **CI/CD:** GitHub Actions
+**Implemented:** 2026-04-13 · **Last refreshed:** 2026-07-28 (release-please model, current job set)
 
 ---
 
 ## Overview
 
-This document details the implementation of a comprehensive governance pipeline for the `@aziontech/webkit` Vue 3 component library. The pipeline enforces code quality, security, accessibility, and type safety standards on every commit and CI/CD run.
+This document details the implementation of the governance pipeline for the `@aziontech/webkit` Vue 3 component library. The pipeline enforces code quality, security, accessibility, and type safety standards on every commit and CI/CD run.
+
+The construction standards themselves (props, styling, testing, …) are catalogued in [`STYLEGUIDE.md`](./STYLEGUIDE.md) and digested in [`GUIDELINES.md`](./GUIDELINES.md); the full process map is [`PROCESS.md`](./PROCESS.md). This document covers the **tooling**: what runs, where it runs, and why each piece exists.
 
 ---
 
@@ -21,7 +23,7 @@ This document details the implementation of a comprehensive governance pipeline
 4. [Type Coverage](#4-type-coverage)
 5. [Prettier Ignore](#5-prettier-ignore)
 6. [Package Scripts](#6-package-scripts)
-7. [Pre-commit Hooks](#7-pre-commit-hooks)
+7. [Git Hooks](#7-git-hooks)
 8. [GitHub Actions Workflow](#8-github-actions-workflow)
 9. [Dependencies](#9-dependencies)
 
@@ -29,31 +31,31 @@ This document details the implementation of a comprehensive governance pipeline
 
 ## 1. ESLint Configuration
 
-**File:** `/packages/webkit/eslint.config.js`
+**File:** root [`eslint.config.js`](../../../eslint.config.js) — the repo-wide flat config. `packages/webkit/eslint.config.js` is a one-line re-export of it, so running ESLint from the package resolves the exact same rule set.
 
 ### What Was Implemented
 
-Migrated from `.eslintrc.*` to ESLint 9 flat config format (`eslint.config.js`) with comprehensive Vue 3 + TypeScript rules.
+ESLint 9 flat config (`eslint.config.js`) with Vue 3 + TypeScript rules, migrated from the legacy `.eslintrc.*` format.
 
 ### Reasoning
 
-| Rule/Feature                             | Reason                                                                                                                                                                                                         |
-| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **ESLint 9 flat config**                 | ESLint 9+ requires the new `eslint.config.js` format. The legacy `.eslintrc.*` format is deprecated and will be removed in future versions. This ensures forward compatibility.                                |
-| **`vue/vue3-recommended`**               | Provides Vue 3 Composition API-specific rules. Upgraded from `essential` to `recommended` for stricter enforcement of Vue best practices (e.g., proper lifecycle hooks, template syntax).                      |
-| **`@typescript-eslint`**                 | TypeScript-specific linting catches type errors at lint time rather than build time. Rules like `no-explicit-any` prevent unsafe `any` usage that undermines type safety.                                      |
-| **`vue/no-v-html` (error)**              | Prevents XSS vulnerabilities. `v-html` allows arbitrary HTML injection which can lead to cross-site scripting attacks. Components should use text interpolation or sanitize HTML.                              |
-| **`vue/require-default-prop` (error)**   | Ensures all optional props have default values. This prevents `undefined` runtime errors and makes component behavior predictable. Required for zero warnings policy.                                          |
-| **`vue/require-explicit-emits` (error)** | Forces explicit declaration of emitted events via `defineEmits`. This improves component API documentation, enables IDE autocomplete, and catches typos in event names.                                        |
-| **`vuejs-accessibility` plugin**         | Vue-specific accessibility rules (not React's `jsx-a11y`). Catches a11y violations like missing alt text, improper ARIA attributes, and click handlers without keyboard support. Critical for WCAG compliance. |
-| **`simple-import-sort`**                 | Automatically sorts imports alphabetically. Prevents merge conflicts in teams, makes diffs cleaner, and improves code readability.                                                                             |
-| **`unused-imports`**                     | Removes unused imports during auto-fix. Dead imports increase bundle size and indicate incomplete refactoring.                                                                                                 |
-| **`import/no-duplicates`**               | Prevents importing the same module multiple times. Redundant imports can lead to initialization side effects running twice.                                                                                    |
-| **`no-console` (error)**                 | Prevents `console.log` statements in production code. Console statements can leak sensitive information and degrade performance. Developers should use proper logging libraries or remove debug code.          |
-| **`no-debugger` (error)**                | Prevents `debugger` statements. These halt execution in production and should never be committed.                                                                                                              |
-| **`prefer-const` (error)**               | Enforces `const` for variables that are never reassigned. Signals intent clearly and prevents accidental reassignment.                                                                                         |
-| **`vue-eslint-parser`**                  | Parses `.vue` single-file components with `<script setup>` syntax. Required for Vue 3 Composition API support.                                                                                                 |
-| **`--max-warnings 0`**                   | Enforces zero warnings policy. Warnings accumulate technical debt. By treating all warnings as errors, code quality is maintained consistently.                                                                |
+| Rule/Feature                             | Reason                                                                                                                                                                                                                                                           |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **ESLint 9 flat config**                 | ESLint 9+ requires the new `eslint.config.js` format. The legacy `.eslintrc.*` format is deprecated. This ensures forward compatibility.                                                                                                                         |
+| **Hand-picked `vue/*` rules at `error`** | On top of `js.configs.recommended`, the config enables specific Vue rules (PascalCase component naming/casing, `no-v-html`, `require-default-prop`, `require-explicit-emits`, …) rather than spreading a preset — every enabled rule is deliberate and blocking. |
+| **`@typescript-eslint`**                 | TypeScript-specific linting catches type errors at lint time rather than build time. `no-explicit-any` (error) prevents unsafe `any` usage that undermines type safety.                                                                                          |
+| **`vue/no-v-html` (error)**              | Prevents XSS vulnerabilities. `v-html` allows arbitrary HTML injection which can lead to cross-site scripting attacks. Components should use text interpolation or sanitize HTML.                                                                                |
+| **`vue/require-default-prop` (error)**   | Ensures all optional props have default values. This prevents `undefined` runtime errors and makes component behavior predictable. Required for zero warnings policy.                                                                                            |
+| **`vue/require-explicit-emits` (error)** | Forces explicit declaration of emitted events via `defineEmits`. This improves component API documentation, enables IDE autocomplete, and catches typos in event names.                                                                                          |
+| **`vuejs-accessibility` plugin**         | Vue-specific accessibility rules (not React's `jsx-a11y`). `alt-text`, `aria-props`, `aria-role`, `click-events-have-key-events` run at `error`. Critical for WCAG compliance.                                                                                   |
+| **`simple-import-sort`**                 | Automatically sorts imports alphabetically. Prevents merge conflicts in teams, makes diffs cleaner, and improves code readability.                                                                                                                               |
+| **`unused-imports`**                     | Removes unused imports during auto-fix. Dead imports increase bundle size and indicate incomplete refactoring.                                                                                                                                                   |
+| **`import/no-duplicates`**               | Prevents importing the same module multiple times. Redundant imports can lead to initialization side effects running twice.                                                                                                                                      |
+| **`no-console` (error)**                 | Prevents `console.log` in production code (only `console.warn` / `console.error` are allowed). Console statements can leak sensitive information and degrade performance.                                                                                        |
+| **`no-debugger` (error)**                | Prevents `debugger` statements. These halt execution in production and should never be committed.                                                                                                                                                                |
+| **`prefer-const` (error)**               | Enforces `const` for variables that are never reassigned. Signals intent clearly and prevents accidental reassignment.                                                                                                                                           |
+| **`vue-eslint-parser`**                  | Parses `.vue` single-file components with `<script setup>` syntax. Required for Vue 3 Composition API support.                                                                                                                                                   |
+| **`--max-warnings 0`**                   | Enforces zero warnings policy (set in the `lint` script). Warnings accumulate technical debt. By treating all warnings as errors, code quality is maintained consistently.                                                                                       |
 
 ### Zero Warnings Policy
 
@@ -68,7 +70,7 @@ All rules are set to `error` level. This enforces:
 
 ## 2. Stylelint Configuration
 
-**Files:** root [`.stylelintrc.json`](../../../.stylelintrc.json) (repo-wide config) + the `"stylelint"` key in [`packages/webkit/package.json`](../package.json)
+**File:** root [`.stylelintrc.json`](../../../.stylelintrc.json) — the single repo-wide config (there is no per-package stylelint config).
 
 ### What Was Implemented
 
@@ -76,59 +78,63 @@ Stylelint configuration with SCSS support and Vue integration.
 
 ### Reasoning
 
-| Rule/Feature                                            | Reason                                                                                                                                                                      |
-| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Stylelint setup**                                     | Although current CSS usage is minimal (`country-flags.css` only), this future-proofs the codebase. As the component library grows, CSS rules will be enforced from day one. |
-| **`stylelint-config-standard-scss`**                    | SCSS-specific linting rules. Validates proper use of variables, mixins, functions, and nested syntax.                                                                       |
-| **`stylelint-config-recommended-vue`**                  | Vue-specific CSS linting. Validates styles in `<style>` blocks of `.vue` files.                                                                                             |
-| **`stylelint-order` plugin**                            | Enforces alphabetical property ordering. Makes styles predictable and easier to scan. Reduces cognitive load when reviewing styles.                                         |
-| **`selector-class-pattern`**                            | Enforces `kebab-case` for CSS classes (`my-component`). Prevents inconsistent naming like `myComponent` or `MyComponent`. Matches Vue style guide recommendations.          |
-| **`no-descending-specificity` (warn)**                  | Prevents specificity conflicts where later rules override earlier ones unexpectedly. Set to `warn` initially as this can be a design decision.                              |
-| **`declaration-block-no-duplicate-properties` (error)** | Prevents accidental duplicate properties like `color: red; color: blue;`. Usually indicates copy-paste errors.                                                              |
-| **`no-duplicate-selectors` (error)**                    | Prevents duplicate selectors in the same stylesheet. Indicates refactoring oversights.                                                                                      |
-| **`property-no-vendor-prefix` (warn)**                  | Discourages manual vendor prefixes (`-webkit-`, `-moz-`). Autoprefixer (PostCSS) should handle these automatically.                                                         |
-| **`selector-max-id: 0`**                                | Disallows ID selectors in CSS. Enforces component-scoped styles using classes. IDs create specificity issues and prevent reusability.                                       |
+| Rule/Feature                                                      | Reason                                                                                                                                                                                                       |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Stylelint setup**                                               | Component-local CSS is banned by the styling standard (styles live as Tailwind utilities on the root element), so the lintable CSS surface is deliberately small — but what exists is enforced from day one. |
+| **`stylelint-config-standard-scss`**                              | SCSS-specific linting rules. Validates proper use of variables, mixins, functions, and nested syntax.                                                                                                        |
+| **`stylelint-config-recommended-vue`**                            | Vue-specific CSS linting. Validates styles in `<style>` blocks of `.vue` files.                                                                                                                              |
+| **`stylelint-order` plugin**                                      | Enforces alphabetical property ordering. Makes styles predictable and easier to scan. Reduces cognitive load when reviewing styles.                                                                          |
+| **`selector-class-pattern`**                                      | Enforces `kebab-case` for CSS classes (`my-component`). Prevents inconsistent naming like `myComponent` or `MyComponent`. Matches Vue style guide recommendations.                                           |
+| **`no-descending-specificity` (warn)**                            | Prevents specificity conflicts where later rules override earlier ones unexpectedly. Set to `warn` as this can be a design decision.                                                                         |
+| **`declaration-block-no-duplicate-properties` (error)**           | Prevents accidental duplicate properties like `color: red; color: blue;`. Usually indicates copy-paste errors.                                                                                               |
+| **`no-duplicate-selectors` (error)**                              | Prevents duplicate selectors in the same stylesheet. Indicates refactoring oversights.                                                                                                                       |
+| **`property-no-vendor-prefix` / `value-no-vendor-prefix` (warn)** | Discourages manual vendor prefixes (`-webkit-`, `-moz-`). Autoprefixer (PostCSS) handles these automatically.                                                                                                |
+| **`selector-max-id: 0`**                                          | Disallows ID selectors in CSS. Enforces component-scoped styles using classes. IDs create specificity issues and prevent reusability.                                                                        |
+| **Tailwind at-rules allowed**                                     | `scss/at-rule-no-unknown` ignores Tailwind's at-rules (`source`, `theme`, `utility`, `custom-variant`, `plugin`, `reference`) so theme CSS lints cleanly.                                                    |
 
 ---
 
 ## 3. TypeScript Configuration
 
-**File:** `/packages/webkit/tsconfig.json`
+**Files:** root [`tsconfig.base.json`](../../../tsconfig.base.json) (shared strictness) + [`packages/webkit/tsconfig.json`](../tsconfig.json) (extends the base, adds declaration emit).
 
 ### What Was Implemented
 
-Enhanced TypeScript strictness with additional compiler options.
+Strict TypeScript shared across the monorepo, with the webkit package layering declaration-emit options on top.
 
 ### Reasoning
 
-| Option                                         | Reason                                                                                                                                                                                            |
-| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`noImplicitReturns: true`**                  | Ensures all code paths return a value. Prevents functions that implicitly return `undefined` when a return type is expected. Catches missing return statements in branches.                       |
-| **`noImplicitOverride: true`**                 | Requires explicit `override` keyword when overriding inherited members. Prevents accidental overrides when base class methods change. Makes inheritance hierarchies clearer.                      |
-| **`noPropertyAccessFromIndexSignature: true`** | Disallows accessing index signature properties with dot notation (`obj.property`). Requires bracket notation (`obj['property']`). Makes it explicit that the property is dynamically accessed.    |
-| **`noUnusedLocals: true`**                     | Reports unused local variables. Indicates incomplete refactoring or dead code. Keeps codebase clean.                                                                                              |
-| **`noUnusedParameters: true`**                 | Reports unused function parameters. If a parameter is unused, it should be prefixed with `_` (e.g., `_event`) to indicate intentional. Prevents confusion about required vs. optional parameters. |
-| **`strict: true` (existing)**                  | Enables all strict type checking options. Already present, but now supplemented with additional checks above.                                                                                     |
+| Option                                                       | Where  | Reason                                                                                                                                                                                            |
+| ------------------------------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`strict: true`**                                           | base   | Enables all strict type checking options.                                                                                                                                                         |
+| **`noImplicitReturns: true`**                                | base   | Ensures all code paths return a value. Prevents functions that implicitly return `undefined` when a return type is expected. Catches missing return statements in branches.                       |
+| **`noImplicitOverride: true`**                               | base   | Requires explicit `override` keyword when overriding inherited members. Prevents accidental overrides when base class methods change. Makes inheritance hierarchies clearer.                      |
+| **`noUnusedLocals: true`**                                   | base   | Reports unused local variables. Indicates incomplete refactoring or dead code. Keeps codebase clean.                                                                                              |
+| **`noUnusedParameters: true`**                               | base   | Reports unused function parameters. If a parameter is unused, it should be prefixed with `_` (e.g., `_event`) to indicate intentional. Prevents confusion about required vs. optional parameters. |
+| **`noPropertyAccessFromIndexSignature: true`**               | webkit | Disallows accessing index signature properties with dot notation (`obj.property`). Requires bracket notation (`obj['property']`). Makes it explicit that the property is dynamically accessed.    |
+| **`declaration` + `declarationMap` + `emitDeclarationOnly`** | webkit | The same tsconfig drives publish-time `.d.ts` emit (see [§8 — Build Job](#build-job-details)). CI validation runs `vue-tsc --noEmit`, so declarations are never built in dev or CI.               |
+
+Test files (`*.test.ts`, `src/test/`) and Code Connect files (`*.figma.ts`) are excluded from the program — they are development artifacts, not part of the published type surface.
 
 ---
 
 ## 4. Type Coverage
 
-**File:** `/packages/webkit/type-coverage.json`
+**File:** [`packages/webkit/type-coverage.json`](../type-coverage.json)
 
 ### What Was Implemented
 
-Type coverage configuration enforcing 95% type safety threshold.
+Type coverage configuration enforcing a 95% type safety threshold (the `type-coverage` script also passes `--at-least 95 --detail` explicitly).
 
 ### Reasoning
 
-| Setting                                                   | Reason                                                                                                                                                                                                         |
-| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`atLeast: 95`**                                         | Sets minimum type coverage to 95%. This means 95% of code must have explicit types rather than `any`. Balances strictness with pragmatism—allows 5% for complex third-party integrations or gradual migration. |
-| **`strict: true`**                                        | Enables strict type coverage checks. Counts only fully-typed code, not partially-typed.                                                                                                                        |
-| **`detail: true`**                                        | Provides detailed report showing which files/lines lack types. Helps developers understand exactly where to add types.                                                                                         |
-| **`ignoreCatch: true`**                                   | Ignores catch clause variables. TypeScript defaults catch variables to `any`, and typing them requires `unknown` with type guards. Too noisy for initial adoption.                                             |
-| **`ignoreFiles: ["**/\*.d.ts", "**/node_modules/**"]`\*\* | Excludes declaration files and dependencies. Focus on project source code only.                                                                                                                                |
+| Setting                                                                 | Reason                                                                                                                                                                                                         |
+| ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`atLeast: 95`**                                                       | Sets minimum type coverage to 95%. This means 95% of code must have explicit types rather than `any`. Balances strictness with pragmatism—allows 5% for complex third-party integrations or gradual migration. |
+| **`strict: true`**                                                      | Enables strict type coverage checks. Counts only fully-typed code, not partially-typed.                                                                                                                        |
+| **`detail: true`**                                                      | Provides detailed report showing which files/lines lack types. Helps developers understand exactly where to add types.                                                                                         |
+| **`ignoreCatch: true`**                                                 | Ignores catch clause variables. TypeScript defaults catch variables to `any`, and typing them requires `unknown` with type guards. Too noisy for initial adoption.                                             |
+| **`ignoreFiles: ["**/*.d.ts", "**/*.d.ts.map", "**/node_modules/**"]`** | Excludes declaration files (generated) and dependencies. Focus on project source code only.                                                                                                                    |
 
 ### Why Type Coverage Matters
 
@@ -141,22 +147,25 @@ Type coverage configuration enforcing 95% type safety threshold.
 
 ## 5. Prettier Ignore
 
-**File:** `/packages/webkit/.prettierignore`
+**Files:** [`packages/webkit/.prettierignore`](../.prettierignore) + the root [`.prettierignore`](../../../.prettierignore)
 
 ### What Was Implemented
 
-Prettier ignore file to exclude generated/built files from formatting.
+Prettier ignore files excluding generated/built files from formatting.
 
 ### Reasoning
 
-| Pattern                    | Reason                                                                                                |
-| -------------------------- | ----------------------------------------------------------------------------------------------------- |
-| **`dist/`**                | Build output shouldn't be formatted. Regenerated on each build anyway.                                |
-| **`*.min.css`**            | Minified files are already processed. Formatting would break minification.                            |
-| **`node_modules/`**        | Third-party code. Not project source, shouldn't be modified.                                          |
-| **`*.d.ts`, `*.d.ts.map`** | TypeScript declaration files are auto-generated by `vue-tsc`. Formatting them creates noise in diffs. |
-| **`coverage/`**            | Test coverage reports are generated by test runners.                                                  |
-| **`storybook-static/`**    | Storybook static build output. Regenerated on each build.                                             |
+| Pattern                     | Reason                                                                                                                                                                                 |
+| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`dist/`**                 | Build output shouldn't be formatted. Regenerated on each build anyway.                                                                                                                 |
+| **`*.min.css`**             | Minified files are already processed. Formatting would break minification.                                                                                                             |
+| **`node_modules/`**         | Third-party code. Not project source, shouldn't be modified.                                                                                                                           |
+| **`*.d.ts`, `*.d.ts.map`**  | TypeScript declaration files are auto-generated by `vue-tsc`. Formatting them creates noise in diffs.                                                                                  |
+| **`coverage/`**             | Test coverage reports are generated by test runners.                                                                                                                                   |
+| **`storybook-static/`**     | Storybook static build output. Regenerated on each build.                                                                                                                              |
+| **`catalog.json`**          | Generated by `scripts/build-catalog.mjs`; formatting a generated file would create drift against its generator.                                                                        |
+| **`CHANGELOG.md`**          | Generated by release-please; never hand-formatted.                                                                                                                                     |
+| **`lint-canaries/`** (root) | The canary fixtures are **deliberately** rule-breaking / mis-formatted and must keep failing their lints (see §8 — Lint Canary). A repo-wide `prettier --write` must never "fix" them. |
 
 ---
 
@@ -170,31 +179,46 @@ Comprehensive npm scripts for local development and CI/CD.
 
 ### Reasoning
 
-#### Webkit Package Scripts
-
-| Script              | Reason                                                                                                                   |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| **`lint`**          | Runs ESLint with zero warnings policy (`--max-warnings 0`). Catches code quality issues before commit.                   |
-| **`lint:fix`**      | Auto-fixes ESLint issues where possible. Saves developer time for formatting, import sorting, etc.                       |
-| **`lint:style`**    | Runs Stylelint on CSS/SCSS/Vue files. Validates styles against standards.                                                |
-| **`format`**        | Auto-formats all code with Prettier. Ensures consistent code style across team.                                          |
-| **`format:check`**  | Checks formatting without modifying files. Used in CI to fail if code isn't formatted.                                   |
-| **`type-check`**    | Runs `vue-tsc --noEmit`. Validates TypeScript types without generating declaration files. Faster than full build for CI. |
-| **`type-coverage`** | Reports type coverage percentage. Enforces 95% threshold. Gives measurable type safety metric.                           |
+#### Webkit Package Scripts — quality checks
+
+| Script                                                    | Reason                                                                                                                   |
+| --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| **`lint`**                                                | Runs ESLint with zero warnings policy (`--max-warnings 0`). Catches code quality issues before commit.                   |
+| **`lint:fix`**                                            | Auto-fixes ESLint issues where possible. Saves developer time for formatting, import sorting, etc.                       |
+| **`lint:style`**                                          | Runs Stylelint on CSS/SCSS/Vue files. Validates styles against standards.                                                |
+| **`format`**                                              | Auto-formats all code with Prettier. Ensures consistent code style across team.                                          |
+| **`format:check`**                                        | Checks formatting without modifying files. Used in CI to fail if code isn't formatted.                                   |
+| **`type-check`**                                          | Runs `vue-tsc --noEmit`. Validates TypeScript types without generating declaration files. Faster than full build for CI. |
+| **`type-coverage`**                                       | Reports type coverage percentage. Enforces 95% threshold. Gives measurable type safety metric.                           |
+| **`test`** (+ `test:watch` / `test:coverage` / `test:ui`) | Vitest **browser mode** (Playwright Chromium) — the functional per-component suites required by the testing standard.    |
+
+#### Webkit Package Scripts — governance gates
+
+| Script              | Reason                                                                                                                                 |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| **`catalog:check`** | Rebuilds `catalog.json` and fails on any diff — the catalog can never drift from the exports map and specs.                            |
+| **`size`**          | Bundle budget gate (`scripts/check-size.mjs`): builds each budgeted entry with Vite and compares gzipped output to `.size-limit.json`. |
+| **`pack:check`**    | Fails if any `*.test.ts` / `src/test/**` file would ship in the npm tarball (publish safety).                                          |
+| **`test:gate`**     | Fails if any root component lacks its co-located `<name>.test.ts` (test-existence gate; never grandfathered).                          |
+| **`test:toolkit`**  | Unit tests for the adoption toolkit itself (ESLint rules, MCP, CLI, stylelint config).                                                 |
+| **`authoring`**     | Construction-standard ratchet — no **new** authoring violations against the baseline (`authoring:update` re-baselines).                |
+| **`doc-standards`** | Skill/agent doc-standards ratchet — no new out-of-standard `.claude` docs (`doc-standards:update` re-baselines).                       |
+| **`smoke:consume`** | Scaffolds and builds a bare consumer app against the local package — proves `init` + a consumer build still work.                      |
 
 #### Root Package Scripts
 
-| Script               | Reason                                                                                                                          |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| **`prepare`**        | Runs `husky` to initialize Git hooks after `pnpm install`. Ensures hooks are set up on every machine.                           |
-| **`governance`**     | Unified command running all checks: `lint`, `type-check`, `format:check`, `security:audit`. Single command for full validation. |
-| **`security:audit`** | Runs `pnpm audit --audit-level=high`. Checks for known vulnerabilities in dependencies.                                         |
+| Script               | Reason                                                                                                                                                                                                            |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`prepare`**        | Runs `husky` to initialize Git hooks after `pnpm install`. Ensures hooks are set up on every machine.                                                                                                             |
+| **`webkit:*`**       | Delegation scripts (`webkit:lint`, `webkit:type-check`, `webkit:format:check`, `webkit:test`, …) via `pnpm --filter webkit`, so any check runs from the repo root — these are the entry points CI calls.          |
+| **`governance`**     | Unified command running all static checks: `webkit:lint` + `webkit:lint:style` + `webkit:format:check` + `webkit:type-check` + `webkit:type-coverage` + `security:audit`. Single command to reproduce CI locally. |
+| **`security:audit`** | Runs plain **`pnpm audit`** — any severity fails (deliberately stricter than `--audit-level=high`). Accepted-risk overrides live in `pnpm-workspace.yaml`, not in a lowered threshold.                            |
 
 ### Design Decisions
 
 1. **Separate commands vs. unified**:
    - Individual commands allow targeted fixes (e.g., just run `lint:fix`)
-   - `governance` command provides one-stop validation for CI
+   - `governance` command provides one-stop validation for CI parity
 
 2. **Root vs. package scripts**:
    - Root scripts use `pnpm --filter webkit` to delegate
@@ -202,70 +226,70 @@ Comprehensive npm scripts for local development and CI/CD.
 
 ---
 
-## 7. Pre-commit Hooks
+## 7. Git Hooks
 
-**Files:** `/.husky/pre-commit`, `/package.json` (lint-staged config)
+**Files:** `/.husky/pre-commit`, `/.husky/commit-msg`, `/package.json` (lint-staged config)
 
 ### What Was Implemented
 
-Husky Git hooks with lint-staged configuration.
+Husky Git hooks: lint-staged on `pre-commit`, commitlint on `commit-msg`.
 
 ### Reasoning
 
-| Aspect                          | Reason                                                                                                                                                           |
-| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Husky setup**                 | Git hooks run automatically on `git commit`. Catches issues before they reach CI. Faster feedback loop than waiting for CI build.                                |
-| **lint-staged**                 | Only lints staged files (changed files in commit), not entire codebase. Dramatically faster than running full lint. Makes commits quick even in large codebases. |
-| **`--max-warnings 0` in hook**  | Enforces zero warnings policy in pre-commit. Developers must fix issues locally before pushing.                                                                  |
-| **ESLint + Prettier together**  | ESLint fixes code quality, Prettier fixes formatting. Both run in sequence on staged files.                                                                      |
-| **Stylelint + Prettier on CSS** | Same dual approach for styles. Stylelint for rules, Prettier for formatting.                                                                                     |
+| Aspect                          | Reason                                                                                                                                                                                                                                  |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Husky setup**                 | Git hooks run automatically on `git commit`. Catches issues before they reach CI. Faster feedback loop than waiting for CI build.                                                                                                       |
+| **lint-staged (`pre-commit`)**  | Only lints staged files (changed files in commit), not entire codebase. Dramatically faster than running full lint. Makes commits quick even in large codebases.                                                                        |
+| **commitlint (`commit-msg`)**   | `commitlint --edit` validates the message against Conventional Commits with the repo's type enum. Since release-please computes releases from these types (squash-merged PR titles), an invalid type is a release bug, not a style nit. |
+| **`--max-warnings 0` in hook**  | Enforces zero warnings policy in pre-commit. Developers must fix issues locally before pushing.                                                                                                                                         |
+| **ESLint + Prettier together**  | ESLint fixes code quality, Prettier fixes formatting. Both run in sequence on staged `.js/.ts/.vue` files.                                                                                                                              |
+| **Stylelint + Prettier on CSS** | Same dual approach for styles. Stylelint for rules, Prettier for formatting. Staged `.json/.md` files get Prettier alone.                                                                                                               |
 
 ### Performance Optimization
 
 - **Staged files only**: lint-staged only processes files changed in the commit
-- **Cache support**: ESLint and Prettier support `--cache` flag (not used yet, can be added)
 - **Sequential execution**: ESLint → Prettier ensures fixes are formatted
 
-### Skip Hooks (Emergency)
+### Do Not Skip Hooks
 
-```bash
-git commit --no-verify -m "emergency fix"
-```
-
-Use sparingly—only for genuine emergencies.
+`git commit --no-verify` is **not** an accepted path in this repo (see the git-workflow rule): a commit that cannot pass commitlint is a commit with the wrong type, and a lint failure belongs fixed, not bypassed. CI re-runs every check anyway, so skipping only defers the failure.
 
 ---
 
 ## 8. GitHub Actions Workflow
 
-**File:** `/.github/workflows/governance.yml`
+**File:** [`/.github/workflows/governance.yml`](../../../.github/workflows/governance.yml)
 
 ### What Was Implemented
 
-Comprehensive CI/CD pipeline with parallel job execution.
+Comprehensive CI/CD pipeline with path-filtered gating, parallel execution, and sharded browser testing.
 
 ### Reasoning
 
 #### Job Structure
 
-| Job                  | Purpose                                                           | Parallel?           |
-| -------------------- | ----------------------------------------------------------------- | ------------------- |
-| **changes**          | `dorny/paths-filter` gate — `webkit` / `toolkit` change detection | first               |
-| **security**         | Dependency audit, secret detection, unused deps                   | ✅ Yes              |
-| **lint**             | ESLint, Stylelint, Prettier checks                                | ✅ Yes              |
-| **types**            | TypeScript check, type coverage                                   | ✅ Yes              |
-| **build**            | Pack dry run + size-limit                                         | ❌ After lint+types |
-| **storybook**        | Storybook build verification                                      | ❌ After lint+types |
-| **toolkit**          | Catalog drift check, toolkit tests, authoring **ratchet**         | ✅ Yes              |
-| **governance-check** | Summary gate ensuring all jobs passed (or cleanly skipped)        | ❌ After all        |
+| Job                  | Purpose                                                                                              | Runs                                  |
+| -------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------- |
+| **changes**          | `dorny/paths-filter` gate — computes `webkit` / `toolkit` / `tests` / `visual` / `canary` outputs    | always, first                         |
+| **security**         | Dependency audit, secret detection, unused deps                                                      | `webkit` changes, parallel            |
+| **lint-canary**      | Every deliberately-broken fixture in `lint-canaries/` must **still fail** its lint rule              | `canary` changes (lint configs moved) |
+| **lint**             | ESLint (zero warnings), Stylelint, Prettier check                                                    | `webkit` changes, parallel            |
+| **types**            | `vue-tsc --noEmit` + type coverage ≥ 95%                                                             | `webkit` changes, parallel            |
+| **build**            | Publish-safety (`pack:check`) + bundle budget (`size`)                                               | after lint + types                    |
+| **storybook**        | Storybook build verification                                                                         | after lint + types                    |
+| **toolkit**          | Catalog drift, toolkit unit tests, authoring **ratchet**, test-existence gate, doc-standards ratchet | `toolkit` changes, parallel           |
+| **smoke**            | Consumer smoke test — `init` + build a bare consumer app                                             | `visual`-scope changes                |
+| **tests**            | **Vitest browser mode** (Playwright Chromium), 4 shards                                              | after lint + types                    |
+| **visual**           | Storybook visual regression, 4 shards, diff artifacts uploaded on failure                            | after all build/test jobs             |
+| **governance-check** | Summary gate ensuring all jobs passed (or cleanly skipped)                                           | `always()`, last                      |
 
 #### Security Job Details
 
-| Step                                | Reason                                                                                                                                             |
-| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`pnpm audit --audit-level=high`** | Checks for known vulnerabilities in npm dependencies. `high` level catches critical security issues.                                               |
-| **TruffleHog action**               | Scans codebase for accidentally committed secrets (API keys, passwords, tokens). Prevents credential leaks.                                        |
-| **depcheck**                        | Detects unused dependencies in `package.json`. Reduces bundle size and attack surface. Set to `continue-on-error: true` initially (informational). |
+| Step                   | Reason                                                                                                                                                                                  |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **plain `pnpm audit`** | Checks for known vulnerabilities in npm dependencies. **Any severity fails** — the accepted-risk mechanism is explicit overrides in `pnpm-workspace.yaml`, never a lowered audit level. |
+| **TruffleHog action**  | Scans the diff against the default branch for committed secrets (API keys, passwords, tokens), `--only-verified` to avoid false-positive noise.                                         |
+| **depcheck**           | Detects unused dependencies in `package.json` (`--ignores="@types/*,eslint-*"`). Set to `continue-on-error: true` (informational).                                                      |
 
 #### Lint Job Details
 
@@ -275,6 +299,10 @@ Comprehensive CI/CD pipeline with parallel job execution.
 | **Stylelint**      | Validates CSS/SCSS in `.vue` files. Catches styling issues early.          |
 | **Prettier check** | `--check` fails if files aren't formatted. Enforces consistent formatting. |
 
+#### Lint Canary Job
+
+The `lint-canaries/` fixtures each violate exactly one lint rule on purpose. The canary job runs them and fails if any fixture **stops** failing — catching a config regression (a rule accidentally disabled or weakened) that ordinary green builds would never surface. It triggers on changes to the lint configs themselves (`eslint.config.js`, `.stylelintrc.json`, `commitlint.config.js`, `.prettierrc.json`, …), the canaries, or the workflow.
+
 #### Types Job Details
 
 | Step                 | Reason                                                                               |
@@ -284,10 +312,27 @@ Comprehensive CI/CD pipeline with parallel job execution.
 
 #### Build Job Details
 
-| Step                        | Reason                                                                                                                                                                                                                                   |
-| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Depends on lint + types** | Only builds if linting and type checking pass. Prevents wasting CI time on broken code.                                                                                                                                                  |
-| **Pack dry run**            | Validates package can be published. Catches packaging issues early. `.d.ts` declarations are generated at publish time by `vue-tsc --declaration --emitDeclarationOnly` via the package's `.releaserc` `prepareCmd`, not in this CI job. |
+| Step                              | Reason                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Depends on lint + types**       | Only builds if linting and type checking pass. Prevents wasting CI time on broken code.                                                                                                                                                                                                                                                                                                                                                  |
+| **Publish safety (`pack:check`)** | `npm pack --dry-run` must list **no** `*.test.ts` / `src/test/**` files — tests never ship to npm. `.d.ts` declarations are **not** built in this job: they are generated at publish time by the release workflow ([`package-webkit.yml`](../../../.github/workflows/package-webkit.yml) runs `vue-tsc --declaration --emitDeclarationOnly` immediately before `npm publish`, triggered by release-please's `release: published` event). |
+| **Bundle budget (`size`)**        | Every budgeted export entry is compiled (Vite + plugin-vue, vue externalized) and its gzipped size compared against `.size-limit.json`. Budgets only ratchet down.                                                                                                                                                                                                                                                                       |
+
+#### Tests Job Details (Vitest browser mode)
+
+| Aspect                         | Reason                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ |
+| **Real Chromium (Playwright)** | Focus, keyboard, layout, and `<Teleport>` behave for real — jsdom returns no-ops for exactly the behaviors that break in production. |
+| **4 shards**                   | `vitest run --shard=N/4` in a matrix keeps wall-clock time flat as the suite grows.                                                  |
+| **Playwright browser cache**   | `~/.cache/ms-playwright` keyed on the lockfile — skips the browser download on unchanged dependencies.                               |
+
+#### Visual Job Details
+
+| Aspect                        | Reason                                                                                                                             |
+| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| **Runs after everything**     | Visual regression is the most expensive signal; it only runs once security/lint/types/build/storybook/tests are green.             |
+| **4 shards**                  | Same wall-clock strategy as the tests job.                                                                                         |
+| **Diff artifacts on failure** | The `__diff_output__` images upload as workflow artifacts (7-day retention) so a failure is reviewable without re-running locally. |
 
 #### Storybook Job Details
 
@@ -298,25 +343,28 @@ Comprehensive CI/CD pipeline with parallel job execution.
 
 #### Governance Gate Job
 
-| Aspect             | Reason                                                                                                                                          |
-| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`if: always()`** | Runs even if previous jobs failed. Needed to report overall status.                                                                             |
-| **Status check**   | Verifies changes, security, lint, types, build, storybook, and toolkit all succeeded (or were cleanly skipped). Fails the PR if any job failed. |
+| Aspect             | Reason                                                                                                                                                                     |
+| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`if: always()`** | Runs even if previous jobs failed. Needed to report overall status.                                                                                                        |
+| **Status check**   | Verifies all eleven upstream jobs succeeded (or were cleanly skipped by the path filter). Fails the PR if any job failed — the one required check branch protection needs. |
 
 #### Trigger Strategy
 
-| Trigger | Reason |
-| --------------------------------- | --------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| **Pull requests to main and dev** | Catches issues in PRs before merge. Prevents broken code on the integration branches. |
-| **Pushes to main and dev** | Double-checks even after PR merge. Catches direct commits (should be rare). |
-| **`changes` gating job** | `dorny/paths-filter` computes `webkit` (package + lockfile) and `toolkit` (package + `.specs/` + `.claude/hooks | rules/` + storybook) outputs; downstream jobs short-circuit when nothing relevant moved, while the required checks stay registered. |
+| Trigger                     | Reason                                                                                                                                                                  |
+| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Pull requests to `main`** | Catches issues in PRs before merge (`main` is the only integration branch — see the git-workflow rule).                                                                 |
+| **Pushes to `main`**        | Double-checks even after PR merge. Catches direct commits (should be rare).                                                                                             |
+| **`changes` gating job**    | Path filters short-circuit downstream jobs when nothing relevant moved, while the required checks stay registered (skipped counts as passed in the gate).               |
+| **Concurrency group**       | A new push to a PR cancels the superseded run (8 Playwright-sharded jobs are expensive); pushes to `main` queue instead so every landed commit keeps a complete status. |
 
 #### Performance Optimizations
 
-1. **Parallel execution**: Security, lint, types run simultaneously → 3-5 min total instead of 10-15 min sequential
-2. **Conditional builds**: Build/Storybook only run if lint+types pass
-3. **`cache: 'pnpm'`**: Uses GitHub Actions cache for pnpm dependencies → faster installs
+1. **Parallel execution**: security, lint, types, toolkit run simultaneously
+2. **Conditional builds**: build/storybook/tests/visual only run if upstream jobs pass
+3. **`cache: 'pnpm'`** + Playwright browser cache → faster installs
 4. **`--frozen-lockfile`**: Ensures reproducible builds. Fails if lockfile is outdated.
+5. **Sharding (×4)** for the two browser-based suites
+6. **PR concurrency cancellation** — superseded runs stop immediately
 
 ---
 
@@ -324,7 +372,7 @@ Comprehensive CI/CD pipeline with parallel job execution.
 
 ### What Was Installed
 
-All dependencies installed at root level (`pnpm add -D -w`):
+All governance dependencies installed at root level (`pnpm add -D -w`):
 
 | Package                               | Version | Purpose                          |
 | ------------------------------------- | ------- | -------------------------------- |
@@ -344,6 +392,8 @@ All dependencies installed at root level (`pnpm add -D -w`):
 | **stylelint-config-standard-scss**    | ^17.0.0 | SCSS standard rules              |
 | **stylelint-config-recommended-vue**  | ^1.6.1  | Vue CSS rules                    |
 | **stylelint-order**                   | ^8.1.1  | CSS property ordering            |
+| **prettier**                          | ^3.9.4  | Formatting                       |
+| **@commitlint/cli**                   | ^21.0.2 | Conventional Commit validation   |
 | **husky**                             | ^9.1.7  | Git hooks                        |
 | **lint-staged**                       | ^16.4.0 | Lint only staged files           |
 | **type-coverage**                     | ^2.29.7 | Type coverage measurement        |
@@ -368,17 +418,13 @@ The migration from `.eslintrc.*` to `eslint.config.js` was required because:
 - Better support for ESM modules
 - Clearer plugin configuration
 
-### Known Issues After Implementation
+### Release Automation (2026-07)
 
-The initial ESLint run identified issues that need manual fixing:
+The release pipeline moved from semantic-release (per-package `.releaserc` files) to **release-please** (Release-PR model): merging `feat`/`fix` PRs updates a pending Release PR; merging the Release PR tags versions and triggers the `package-*.yml` publish workflows, which build the `.d.ts` declarations and publish to npm. The type→bump mapping this implies is documented in `CONTRIBUTING.md` and enforced identically across commitlint, `release-please-config.json`, and the PR flows.
 
-1. **Missing prop defaults**: Add `withDefaults` to Vue components
-2. **Undefined globals**: Add global type declarations for `fetch`, `setTimeout`, `ResizeObserver`
-3. **Console statements**: Remove or use proper logging
-4. **Missing return types**: Add TypeScript return types to functions
-5. **Accessibility violations**: Add keyboard event handlers
+### Known Issues After Implementation (historical)
 
-These are expected—the governance pipeline is now catching issues that were previously undetected.
+The initial ESLint run identified issues that needed manual fixing — missing prop defaults, undefined globals, console statements, missing return types, accessibility violations. These were expected (the pipeline started catching issues that were previously undetected) and have since been fixed; today the same classes of issue are blocked at commit and in CI.
 
 ---
 
@@ -387,18 +433,21 @@ These are expected—the governance pipeline is now catching issues that were pr
 ### Local Testing
 
 ```bash
-# Run full governance suite
+# Run the full static governance suite (mirrors the lint/types/security jobs)
 pnpm run governance
 
 # Individual checks
-pnpm run lint
-pnpm run type-check
-pnpm run format:check
+pnpm run webkit:lint
+pnpm run webkit:type-check
+pnpm run webkit:format:check
 pnpm run security:audit
 
+# Functional tests (Vitest browser mode)
+pnpm run webkit:test
+
 # Auto-fix issues
-pnpm run lint:fix
-pnpm run format
+pnpm run webkit:lint:fix
+pnpm run webkit:format
 ```
 
 ### Pre-commit Hook Test
@@ -409,47 +458,44 @@ echo "console.log('test')" >> packages/webkit/src/test.js
 git add packages/webkit/src/test.js
 git commit -m "test: pre-commit hook"
 
-# Hook will run ESLint and Prettier
-# Commit will fail if issues found
+# pre-commit runs ESLint + Prettier on the staged file (fails on no-console);
+# commit-msg validates the message with commitlint
 ```
 
 ### CI/CD Validation
 
 1. Create a PR touching `packages/webkit/`
 2. Navigate to Actions tab in GitHub
-3. Verify all 8 jobs run:
+3. Verify the jobs run:
    - changes (first — path-filter gate)
-   - security (✅ parallel)
-   - lint (✅ parallel)
-   - types (✅ parallel)
-   - toolkit (✅ parallel — catalog drift + tests + authoring ratchet)
-   - build (⏳ after lint+types)
-   - storybook (⏳ after lint+types)
+   - security, lint, types, toolkit (✅ parallel)
+   - lint-canary (when lint configs / canaries moved)
+   - build, storybook, tests ×4 (⏳ after lint + types)
+   - smoke (when visual-scope paths moved)
+   - visual ×4 (⏳ after all build/test jobs)
    - governance-check (⏳ after all)
 
 ---
 
 ## Future Improvements
 
-### Potential Additions
-
-| Improvement                 | Benefit                         | Effort |
-| --------------------------- | ------------------------------- | ------ |
-| **ESLint cache**            | Faster subsequent lint runs     | Low    |
-| **Prettier cache**          | Faster subsequent format checks | Low    |
-| **Bundle size limits**      | Prevent bundle bloat            | Medium |
-| **Dead code detection**     | Find unused exports             | Medium |
-| **Visual regression tests** | Catch UI changes                | High   |
-| **Performance benchmarks**  | Track bundle size over time     | Medium |
+### Shipped Since First Write
 
-### Configuration Tuning
+| Improvement                 | Where it landed                                                      |
+| --------------------------- | -------------------------------------------------------------------- |
+| **Bundle size limits**      | `size` gate in the build job (`check-size.mjs` + `.size-limit.json`) |
+| **Visual regression tests** | the sharded `visual` job                                             |
+| **Functional test gate**    | the sharded `tests` job + `test:gate` existence check                |
+| **Lint-config regression**  | the `lint-canary` job                                                |
 
-As the team adapts to the pipeline:
+### Still Open
 
-1. **Adjust rule severity**: Move some `error` rules to `warn` if too strict
-2. **Type coverage threshold**: Start at 95%, adjust based on reality
-3. **Add eslint-disable comments**: For intentional exceptions
-4. **Extend import patterns**: Add custom import order rules
+| Improvement                | Benefit                         | Effort |
+| -------------------------- | ------------------------------- | ------ |
+| **ESLint cache**           | Faster subsequent lint runs     | Low    |
+| **Prettier cache**         | Faster subsequent format checks | Low    |
+| **Dead code detection**    | Find unused exports             | Medium |
+| **Performance benchmarks** | Track bundle size over time     | Medium |
 
 ---
 
@@ -472,7 +518,7 @@ pnpm run prepare  # Re-initialize hooks
 #### Type Coverage Too Low
 
 ```bash
-pnpm run type-coverage  # See detailed report
+pnpm run webkit:type-coverage  # See detailed report
 ```
 
 #### CI Job Failing Locally
@@ -485,23 +531,23 @@ pnpm run governance  # Reproduce locally before pushing
 
 ## Conclusion
 
-This governance pipeline establishes a foundation for code quality, security, and maintainability. It catches issues early (pre-commit), provides fast feedback (parallel CI jobs), and enforces standards consistently (zero warnings policy).
+This governance pipeline establishes a foundation for code quality, security, and maintainability. It catches issues early (pre-commit), provides fast feedback (parallel, path-filtered CI jobs), and enforces standards consistently (zero warnings policy, ratchets that only tighten).
 
 The pipeline is **strict by default** but **configurable**—adjust rules as needed based on team feedback and project requirements.
 
 **Key Benefits:**
 
-✅ **Security**: Dependency audits, secret detection  
-✅ **Quality**: Linting, formatting, type safety  
+✅ **Security**: Dependency audits (any severity), secret detection  
+✅ **Quality**: Linting, formatting, type safety, functional browser tests  
 ✅ **Accessibility**: Vue-specific a11y rules  
-✅ **Consistency**: Automated formatting, import sorting  
-✅ **Performance**: Parallel CI jobs, staged file linting  
-✅ **Developer Experience**: Auto-fixing, clear error messages  
-✅ **Maintainability**: Type coverage metrics, no unused code
+✅ **Consistency**: Automated formatting, import sorting, lint canaries  
+✅ **Performance**: Parallel CI jobs, path filtering, sharding, staged file linting  
+✅ **Developer Experience**: Auto-fixing, clear error messages, one-command CI parity  
+✅ **Maintainability**: Type coverage metrics, bundle budgets, no unused code
 
 ---
 
 **Implemented by:** Claude Code
-**Date:** 2026-04-13
+**Implemented:** 2026-04-13 · **Last refreshed:** 2026-07-28
 **Package:** @aziontech/webkit
 **Framework:** Vue 3 + TypeScript + Composition API