Publication gate: why real test records are mandatory
The build-time validator scripts/validate-workflows.mjs reads every src/content/workflows/{zh,en}/*.json and public/workflows/<id>/: it computes real SHA-256 sums, compares them with envelope checksums, validates UI/API structure against workflowFormat, checks bilingual same-id/different-locale pairs and scans for local paths, credentials, private addresses, internal hostnames and real personal data.
A status:"published" entry must have all of: non-null testedAt, non-empty testEvidence, at least one model with a non-empty revision, at least one exampleAssets entry, and an existing download file. Any omission fails npm run build and npm run check. Tests include a deliberately bad published fixture (rejected) and a valid draft fixture (accepted).
No GPU was available this round, so all 3 entries are draft with testedAt:null. The site builds, but the entries stay draft and are excluded from the public catalog.