release: bump version to 0.72.0

docs/HARNESS.md

@@ -9,7 +9,7 @@ or release workflows.
 Existing project rules are authoritative:
 
 1. `rules.md`
-2. `agents.md`
+2. `AGENTS.md`
 3. Current implementation docs under `docs/technical/`
 4. Existing scripts, especially `planet.sh`
 5. Existing Gitea workflow files under `.gitea/workflows/`
@@ -18,6 +18,12 @@ When harness guidance conflicts with any of the above, keep the existing rule,
 do not overwrite the existing workflow, and add a compatibility note here or in
 `docs/harness-audit.md`.
 
+For frontend or documentation audits, also read the Rules Coverage Evidence
+section in `docs/harness-audit.md`. It maps `rules.md` clauses to the current
+static checks, Playwright smoke coverage, and remaining manual review areas, so
+an agent can distinguish a proved harness pass from a rule that still needs
+human-quality inspection.
+
 ## Starting Work
 
 Recommended startup flow:
@@ -71,8 +77,12 @@ git diff --unified=0 HEAD -- <path>
 | Tier | Command | What It Does |
 | --- | --- | --- |
 | Doctor | `scripts/harness/doctor.sh` | Checks required files, required tools, optional delivery tools, and forbidden frontend lockfiles. |
-| Quick | `scripts/harness/quick-check.sh` | Runs doctor, whitespace diff check, shell syntax checks, and CI backend smoke tests. |
-| Full | `scripts/harness/validate.sh` | Runs quick check, frontend Bun install/build, optional Helm checks, and opt-in Docker image smoke builds. |
+| Security | `scripts/harness/security-check.sh` | Checks that environment/private-key files are not tracked and scans for high-confidence committed secret tokens. |
+| Backend Rules | `scripts/harness/backend-rules-check.sh` | Checks backend app Python for direct `print()`, `breakpoint()`, and `pdb.set_trace()` debug calls so service code uses structured logging. |
+| Frontend Rules | `scripts/harness/frontend-rules-check.sh` | Checks Bun-only scripts, admin route manifest coherence, literal internal route links, admin search route targets, frontend debug output, native button safety, icon-button accessibility, no nested Cards, no AntD/Space layout primitives, ConnectionTestInput usage, admin/docs shell height-chain sizing, viewport-scaled font sizes, zero letter spacing, and high-signal UI rule warnings. |
+| Docs Consistency | `scripts/harness/docs-consistency-check.sh` | Checks frontend Docs metadata against backend Gatekeeper metadata, public Docs registration, full technical-doc bilingual file pairs, public doc links, readable link titles, language-scoped technical links, README/project-context admin stack drift, supported credential collector contracts, manual console route coverage against the actual admin manifest, documented UI route drift, documented `?section=` deep-link validity against the actual admin section config in technical docs and active plan docs, and the harness rules-coverage notes. |
+| Quick | `scripts/harness/quick-check.sh` | Runs doctor, whitespace diff check, shell syntax checks, security scan, backend/frontend/doc consistency checks, and CI backend smoke tests. |
+| Full | `scripts/harness/validate.sh` | Runs quick check, frontend Bun install/build, Playwright route smoke, optional Helm checks, and opt-in Docker image smoke builds. |
 
 Docker image smoke builds are expensive and are off by default:
 
@@ -80,6 +90,36 @@ Docker image smoke builds are expensive and are off by default:
 PLANET_HARNESS_DOCKER_SMOKE=1 scripts/harness/validate.sh
 ```
 
+Frontend Playwright smoke runs by default in full validation after the frontend
+build. It starts a local Vite preview and checks the `/` to Earth redirect,
+public pages, unknown-route login fallback, protected admin route login
+fallback, authenticated unknown-route fallback to `/admin`, Docs loading with
+mocked API content, Docs detail page
+language/theme/search interactions, every Docs catalog slug exposed by the
+frontend/backend metadata, the Earth iframe entry point, login error handling,
+register + email verification, password reset, standalone email verification,
+and authenticated `super_admin` rendering for every admin route plus core
+`section` deep links derived from the actual admin route and section config.
+Authenticated admin
+checks run at desktop size, mobile size, and 125% / 150% zoom; desktop and
+mobile passes also fail on global horizontal overflow so table/detail panels
+must keep overflow ownership inside their own scroll regions. The smoke also
+derives the sidebar menu from the actual admin route manifest and clicks every
+visible `super_admin` menu entry on both desktop and mobile viewports, then
+exercises safe interaction paths for admin search, section tabs, the AI settings
+shortcut, logs view switching, user dialog opening, and data distribution toggles.
+It also exercises Earth News source testing, add/cancel source draft behavior,
+and manual news group creation against mocked `/earth/news-*` APIs.
+Documented AI and collector
+deep links such as `/ai?section=integrations`, `/ai?section=playground`, and
+`/collection-management?section=collector_credentials` are part of the rendered
+smoke surface:
+
+```bash
+PLANET_HARNESS_FRONTEND_SMOKE=0 scripts/harness/validate.sh
+PLANET_HARNESS_FRONTEND_SMOKE_PORT=4174 scripts/harness/validate.sh
+```
+
 ## Environment Requirements
 
 Required for normal development:
@@ -89,6 +129,12 @@ Required for normal development:
 - `bun` for frontend dependency and build execution
 - Python resolved by `uv` from the root `pyproject.toml`
 
+Harness command lookup first checks the current non-interactive `PATH`. If a
+required tool is not visible there, `scripts/harness/lib.sh` asks the user's
+login interactive shell (`$SHELL`, then `zsh`, then `bash`) for the command
+path. This avoids hardcoding a dotfile while still covering agent environments
+that do not inherit the user's normal shell setup.
+
 Required for full local stack operation:
 
 - Docker and Docker Compose
@@ -121,6 +167,14 @@ No automatic hooks are installed in this phase. Manual reminders:
 
 - Run `scripts/harness/quick-check.sh` before handing off small changes.
 - Run `scripts/harness/validate.sh` before larger cross-subsystem changes.
+- Run `scripts/harness/security-check.sh` after touching config, auth,
+  credentials, docs examples, or generated fixtures.
+- Run `scripts/harness/backend-rules-check.sh` after backend service edits to
+  catch direct stdout/debugger calls before they reach runtime logs.
+- Run `scripts/harness/frontend-rules-check.sh` after frontend edits to expose
+  route, package-manager, debug-output, and UI rule warnings.
+- Run `scripts/harness/docs-consistency-check.sh` after docs edits or feature
+  route changes.
 - Add focused tests before modifying backend service behavior or frontend
   workflows.
 - For docs changes, run the checks listed in
@@ -136,6 +190,9 @@ No automatic hooks are installed in this phase. Manual reminders:
 4. Make the smallest behavior-preserving or feature-scoped change.
 5. Run `scripts/harness/quick-check.sh` or a narrower documented command.
 6. Update relevant docs when behavior, workflow, or operations change.
+7. For rendered frontend changes, verify the affected route with Playwright or
+   the full harness smoke, because `bun run build` alone does not prove page
+   usability.
 
 ### Bug Fix
 
@@ -149,7 +206,8 @@ No automatic hooks are installed in this phase. Manual reminders:
 
 1. Read `docs/documentation-coverage-rules.md`.
 2. Route docs by audience: UI users, operations, or second-party developers.
-3. Keep Chinese and English public docs consistent when a public doc pair exists.
+3. Keep Chinese and English technical docs paired by filename; public Docs also
+   need matching frontend/backend metadata when exposed in the product Docs UI.
 4. Run the repository-specific docs checks that match the changed files.
 
 ### Release Or Delivery Change
@@ -161,7 +219,15 @@ release process.
 ## Implementation Notes
 
 - `docs/harness-audit.md` records the discovery pass that led to this harness.
-- `AGENTS.md` is a compatibility entry point for tools that expect the uppercase
-  filename. The existing `agents.md` file remains in place.
+- `AGENTS.md` is the single authoritative agent guide. The older lowercase
+  `agents.md` entry has been merged into it and should remain absent.
 - `CODEMAP.md` is intentionally high level; deeper subsystem docs stay in
   `docs/technical/{zh,en}/`.
+- `scripts/harness/frontend-smoke.mjs` is a lightweight route/section smoke
+  with mocked API data. It proves route shells, auth guards, and primary admin
+  sections render, but it is not a replacement for feature-specific browser QA
+  against a real backend.
+- Frontend smoke prints phase-level progress by default. Use
+  `PLANET_FRONTEND_SMOKE_PROGRESS=verbose` to print each route/menu/doc item
+  when diagnosing a slow or failing smoke run, or set it to `0` to suppress
+  progress lines.