| name | execute-end-to-end |
| description | PREREQUISITE TO ART OF CHOKE. Enforces that the entire CI pipeline runs start-to-finish before any push or deploy. No skipped phases, no soft failures, no 'works on my machine.' Before a single line ships, the full chain must execute and pass in a production-like environment. |
| triggers | {"event_types":["pre-push","pre-deploy","pre-build","phase-reset"],"tier":[1,2,3]} |
| immutable | ["NO phase may be skipped","NO failure may be treated as soft/pass","ALL services must be reachable before pipeline starts","If any phase fails → FULL RESET (fix → re-run from phase 1)","Vercel build must reach `Ready` status, not just pass local build"] |
EXECUTE END TO END — Mandatory Prerequisite to ART OF CHOKE
Definition
EXECUTE END TO END means: before any commit ships to a canonical branch, the complete deployment pipeline must run from the first gate to the last gate in a single invocation, with all intermediate services live and reachable. No piece of the pipeline may be skipped, deferred, or treated as optional. Every gate is a hard block.
The Pipeline (12 phases, locked order)
| Phase | Gate | Hard Fail If |
|---|
| 1 | Commit exists + critical files present | Missing commit, missing file |
| 2 | tsc --noEmit | Any type error |
| 3 | npm run lint | Any lint error |
| 4 | npm test | Any test failure |
| 5 | npm run build | Build failure or non-zero exit |
| 6 | Behavioral coverage (5 flows) | Any FAIL (SKIP with reason OK) |
| 7 | Vercel production deploy | Build error, non-Ready status |
| 8 | Push to origin | Push rejected, remote failure |
| 9 | DNS resolution | Domain does not resolve |
| 10 | Health check (/api/health → 200) | Non-200 response |
| 11 | Logs/reporting | Write failure |
| 12 | Final push of loop artifacts | Push failure |
Pre-Flight Requirements (must be verified BEFORE Phase 1)
- Dev server is running on port 3000 (
curl localhost:3000/api/health → 200)
- SafeKrypte service is reachable on port 5096 (required for behavioral coverage)
- Vercel CLI is installed and authenticated (
vercel whoami succeeds)
- Vercel project is linked (
.vercel/repo.json exists with project ID)
- All environment variables required by the app are present in
.env.local
- Network is available for DNS checks, health checks, and Vercel build
Reset Rule (The Hardest Rule)
If ANY phase fails:
- Stop immediately. Do not attempt to skip the failed phase.
- Fix the root cause. Understand why it failed before retrying.
- Re-run from Phase 1. Not from the failed phase. Start over.
- No partial commits. No "I'll fix it in the next PR." No "that's a pre-existing issue."
This rule exists because the 30-commit main-branch incident at VVU started with a single skipped lint warning.
Behavioral Coverage (Phase 6)
Before Phase 6 can PASS, these 5 flows must be verified against a running API:
| Flow | What It Tests |
|---|
| VC Issuance | Credential issued → GovernanceAnchor anchored → verifiable |
| Circuit Breaker | Halt trigger → throughput drops → audit log entry |
| Webhook HMAC | Event received → HMAC validated → proper auth response |
| SafeKrypte Escrow | Key request → threshold check → escrow state update |
| Ubuntu Pools Contribution | Contribution → Stitch InstantEFT → on-chain receipt |
Run: npx tsx scripts/behavioral-coverage.ts
All 5 must PASS (SKIP allowed with documented reason).
Vercel Build Gate (Phase 7)
vercel deploy --prod --force blocks until build completes (default in CLI v54+)- Status must be
Ready before proceeding to Phase 8
- Previous build errors do not count — only the current run matters
- Vercel CLI absence on canonical branches is a hard fail (not a warning)
Tradeoffs (ART OF CHOKE acknowledges these)
- Slower push cycle: 5-15 minutes per push to
main/compliance-fabric
- Services must be reachable: Dev server, SafeKrypte, Vercel API
- No silent rot: Every push surfaces every issue — no hiding quality debt
- Vercel CLI required: Without it, the loop cannot run on canonical branches
Verification Checklist (pre-flight)
