ci: enforce mockup import boundary + enable dependency report (maturity X1, N2)

.github/workflows/dependency-report.yml

@@ -2,15 +2,16 @@
 # vulnerabilities into a rolling issue. REPORT ONLY — it never updates deps; acting
 # on the report means running the AGENTS.md `dependency` protocol by hand.
 #
-# SHIPPED DISABLED: workflow_dispatch only; the schedule is commented out. To enable
-# the cadence, uncomment `schedule:` and run one dispatch to confirm the issue.
+# Report-only: never updates deps. Fortnightly cadence enabled (07:00 UTC on the
+# 1st and 15th) plus manual dispatch. Acting on the report means running the
+# AGENTS.md `dependency` protocol by hand.
 name: Dependency Report
 
 on:
   workflow_dispatch: {}
-  # schedule:
-  #   # 07:00 UTC on the 1st and 15th.
-  #   - cron: "0 7 1,15 * *"
+  schedule:
+    # 07:00 UTC on the 1st and 15th.
+    - cron: "0 7 1,15 * *"
 
 concurrency:
   group: dependency-report

docs/frontend-architecture.md

@@ -19,4 +19,6 @@
 - Pages and layouts remain Server Components unless they require browser state or event handlers.
 - Route handlers enforce public/private document scope; client filters are never authorization controls.
 - Pre-stream API failures use the public JSON error envelope. SSE error events are reserved for failures after a successful stream begins.
-- Production routes must not import fixture/mockup modules.
+- Production routes must not import fixture/mockup modules. Enforced in CI by the
+  `no-restricted-imports` rule in `eslint.config.mjs` (mockup imports are fenced to
+  `src/app/mockups/**` and the `*-mockups` sources).

eslint.config.mjs

@@ -36,6 +36,29 @@ const eslintConfig = defineConfig([
       "local/require-lucide-icon-aria": "error",
     },
   },
+  // Import boundary: production source must not import design-scratch mockup
+  // modules. Every legitimate mockup import lives under `src/app/mockups/**` (all
+  // 404 in production) or inside the `*-mockups` component sources themselves;
+  // everything else is fenced off so a mockup can't leak into a shipped route.
+  // Verified 2026-07-20: zero violations outside the exempt directories.
+  {
+    files: ["src/**/*.{ts,tsx}"],
+    ignores: ["src/app/mockups/**", "**/*-mockups/**", "**/*-mockups.tsx"],
+    rules: {
+      "no-restricted-imports": [
+        "error",
+        {
+          patterns: [
+            {
+              group: ["**/*-mockups", "**/*-mockups/*", "**/*mockup*"],
+              message:
+                "Production code must not import mockup modules (design-scratch, 404 in production). Mockup routes live under src/app/mockups/**.",
+            },
+          ],
+        },
+      ],
+    },
+  },
   // next/og image routes render <img> through Satori (rasterised server-side,
   // not DOM); next/image cannot run there. Turn the rule off for these files via
   // config rather than a per-file disable directive — the Next plugin reports