Format: infrastructure (4-section). See roadmap §4.1. Status: stub (Phase 1, Week 1). Citation: §2.10 of docs/Epoch-Shield-Design-System-Roadmap.md. Audit patterns #1, #22, #40.

Statement

Production HTML, JS bundles, CSS, and runtime DOM must not contain dev/test fixtures. Specifically banned: e2e-test-*, nip-ees-test-*, tester@chattr.buzz, DevIssueTicker, __DEV_ONLY__, __TEST_FIXTURE__. The ban applies whether the fixture is a string literal in source, an identifier referencing a dev-only component, a JSX text node, or a value persisted to client storage that subsequently renders into UI.

The user-facing manifestation of a violation is the same in every case: a real visitor sees an internal-looking value (a test slug, a debug pill, a tester address) and trust collapses. There is no acceptable severity tier — every leak is a P0.

Why

The visual audit found 31 fixture leaks across 5 distinct kinds in production-styled UI: the dev "1 Issue" pill (14 occurrences), e2e-test-*@chattr.buzz slugs in NIP-05 cards (16 occurrences), and one editable-form variant (screen 81) where the slug pre-fills the display-name input — meaning Save publishes the test slug as the user's actual identity.

Two failure modes drive this:

Dev components ship to prod by default. Without a runtime gate, any component imported into a route renders in every build. Strict mode + dead-code elimination only help when the gate is explicit.
Client storage persists across environments. IndexedDB / localStorage written by an e2e run on localhost:3000 survives into the browser's view of chattr.buzz if the same profile is reused. A "production-only" filter at render time is the only defence.

The cost of a single leak is permanent (audit screenshots are public). The cost of the guard is one ESLint rule, one build script, and one runtime helper. The asymmetry is total.

Enforcement

Three mutually-reinforcing layers. All three must pass for a build to deploy.

1. Runtime gate (source level)

Every component whose name begins with Dev (e.g. DevIssueTicker, future DevQueueInspector) wraps its render in:

if (process.env.NODE_ENV !== 'production' || process.env.NEXT_PUBLIC_E2E === '1') {
  // dev/e2e render
}
return null; // production

Dead-code elimination removes the branch from the production bundle entirely. Runtime values that come from persisted client storage (NIP-05 names, identity slugs) are filtered at the rendering boundary — never trust IndexedDB to be production-clean.

2. ESLint rule (CI lint)

eslint-rules/no-prod-fixture-strings.cjs fails CI if any of the banned patterns appear as a string literal, template element, JSX text node, or Identifier named DevIssueTicker in src/**. The rule does not require control-flow analysis — fixture markers are forbidden in production source files regardless of their containing branch.

Runs automatically as part of npm run lint and Vercel's build (npm run build runs ESLint).

3. Post-build bundle scan (final gate)

scripts/check-bundled-fixtures.mjs greps .next/ after next build for the same patterns across .html, .js, .mjs, .cjs, .json, .css, .txt outputs. Catches leaks the AST analysis cannot — i18n JSON, public/ static files, fixtures shipped via next.config.js rewrites, and any bundled string the lint rule missed.

Wired as a postbuild script in package.json. Vercel's build command (npm test && npm run build) implicitly invokes it. Build fails on any hit; deploy is blocked.

Carve-outs

The following paths are exempt from all three layers:

e2e/** — Playwright tests intentionally generate e2e-test-* identities.
**/__tests__/**, **/*.test.{ts,tsx,cjs,mjs}, **/*.spec.{ts,tsx} — vitest / jest unit tests.
scripts/** — build/infra tooling that may reference fixture patterns (e.g. this guard's own self-test in check-bundled-fixtures.mjs --self-test).
eslint-rules/** — rule definitions and their fixtures.
temp/**, .next/cache/**, .next/trace/** — gitignored or build-cache directories not shipped to clients.
Sourcemaps (*.map) — they may reference absolute paths to e2e/** fixture files; this is a build artifact, not a runtime fixture.

A future fixture pattern that needs to ship to production (none currently planned) requires a §12 decision-log entry justifying the exception and either updating this principle or adding a per-pattern allow-list.

Citation

Audit ledger: temp/visual-audit/redrawn-20260424/_github-issues.md, recurring-counters prelude.

Roadmap: §2.10 (production-fixture guard), §3.1 infrastructure-PR carve-out, §4.1 (S-1 listed in 26 stubs), §6 PR plan row #0.

GH issues (representative): #1425 (Recurring pattern: Dev "1 Issue" pill leaking to prod), #1452 (Remove DevIssueTicker from production landing page), #1535 (Remove DevIssueTicker from all prod routes), #2239 (display-name input pre-filled with e2e-test-7rzn4m).

Decision history

Date	Change
2026-04-25	Initial stub written alongside PR #0. Three-layer guard shipped: runtime convention, ESLint rule, post-build scan.