Clone Asset Localization Gate

Clone Asset Localization Gate

Last Updated: July 2026
Version: 1.0
Tier: Mandatory clone-entry gate before visual QA

What

Every captured site must become independent of its old live origin immediately after source capture and route inventory. This applies to WordPress, Elementor, Breakdance, Duda, Wix, Squarespace, GoHighLevel/LeadConnector, Webflow, hosted builders, and custom HTML.

A clone cannot enter visual QA until it builds and renders independently with the source origin blocked or unavailable.

The repository must own every asset required to reproduce the site. That includes images, CSS, JavaScript, fonts, font stylesheets, SVGs, icons, icon fonts, sprites, favicons, manifests, videos, audio, posters, captions, and dependencies loaded recursively from CSS or JavaScript.

This is not cleanup to perform after visual QA, domain attachment, cutover, or old-host cancellation. Waiting until then creates clones that look complete only while the old website is still serving hidden dependencies.

Who owns it

Primary owner: Website / SEO Specialist
QA owner: Website / SEO Specialist or assigned QA reviewer
Exception approver: The approval owner named in the project record
Escalation owner: Operations or leadership when ownership, licensing, functionality, or an external runtime dependency is unclear

The builder owns discovery, localization, rewriting, manifest accuracy, and static verification. The QA reviewer owns source-blocked runtime proof at desktop and mobile widths. No one may waive the gate by treating an unknown third-party request as harmless.

Steps

1. Capture routes and all source variants

Capture the complete public URL inventory plus the markup and metadata needed to reproduce every retained route. Inspect desktop, tablet, and mobile output separately because builders may emit different fragments, stylesheets, scripts, images, and data attributes at different breakpoints.

Do not begin visual QA yet.

2. Inventory the complete runtime dependency graph

Search source markup, captured head/body files, components, data files, stylesheets, scripts, JSON, and generated output for browser-loaded dependencies.

Include:

• src, href, poster, srcset, data-src, data-srcset, and builder-specific lazy-load attributes
• <picture> sources and responsive image variants
• inline style attributes and CSS background images
• CSS url(...) and @import
• JavaScript strings, chunks, and dynamically loaded resources
• desktop-only and mobile-only source fragments
• icons, sprites, SVG symbols, icon fonts, favicons, touch icons, and manifests
• videos, audio, posters, captions, thumbnails, and downloadable files

Recursively scan every downloaded CSS and JavaScript file until no new required dependencies appear.

3. Classify every dependency

Give every dependency one status:

1. Localize: required presentation or behavior asset copied into the repository.
2. Replace: old-CMS functionality replaced with a Tekton-owned or approved integration.
3. Remove: proven dead source runtime that the static clone does not need.
4. Approved external runtime: necessary service such as a GHL form, map, analytics, review, booking, payment, or chat provider.

“Third party” is not an automatic exception. Every external runtime dependency needs a purpose, owner, and named approval record.

4. Localize all required assets

Download required assets into durable repository folders. Rewrite browser-facing references to local paths, including absolute URLs, protocol-relative URLs, query-string variants, encoded URLs, responsive images, lazy-load attributes, CSS imports, inline styles, and JavaScript-loaded asset URLs.

Do not blindly rewrite semantic production URLs such as canonicals, Open Graph page URLs, schema entity/page URLs, sitemap URLs, or approved integration endpoints. Runtime asset localization and SEO URL normalization are separate operations.

5. Validate every download

For every localized file:

• require a successful HTTP response
• validate the response Content-Type
• reject login pages, bot blocks, 404 pages, redirects to HTML shells, and other HTML saved under asset extensions
• preserve the correct extension or record a deliberate conversion
• verify the built file exists and the preview serves the correct MIME type
• verify fonts, icons, backgrounds, lazy-loaded images, and mobile-specific files actually render

6. Maintain the asset manifest

Create docs/clone-assets-manifest.json or an equivalent machine-readable record:

{
  "sourceOrigin": "https://source.example.com",
  "capturedAt": "2026-07-26T00:00:00Z",
  "assets": [
    {
      "sourceUrl": "https://source.example.com/path/theme.woff2",
      "localPath": "public/assets/fonts/theme.woff2",
      "status": "localized",
      "notes": "Referenced by theme.css"
    }
  ]
}

Each discovered asset needs a source URL, local path when localized, status, and notes or approved exception. An unrecorded dependency fails the gate.

7. Maintain the approved external dependency ledger

Create docs/clone-runtime-dependencies.json or equivalent:

{
  "dependencies": [
    {
      "urlPattern": "https://widgets.example.com/",
      "purpose": "Approved review widget",
      "owner": "Website / SEO Specialist",
      "approvedBy": "Name and approval record"
    }
  ]
}

A dependency with no approval record is not approved.

8. Add the repository verification command

Use the canonical verifier from the static-site-cutover-qa or tekton-website-factory skill bundle, or download the published verifier. Copy it into the client repository as scripts/verify-clone-independence.mjs, then add:

{
  "scripts": {
    "verify:clone-independence": "node scripts/verify-clone-independence.mjs --source-origin=https://source.example.com --root=dist"
  }
}

Run the normal production build, then run npm run verify:clone-independence. The verifier must fail on source-origin leaks, missing local files, HTML/error pages saved as assets, manifest gaps, and malformed approval-ledger entries.

9. Prove runtime independence on an immutable preview

Deploy a noindexed immutable preview and run the verifier with --preview-url=<immutable-url>. The runtime pass uses Playwright, so install it in the clone repository if needed.

During the browser pass:

1. Block the source origin using browser request routing, DNS override, or an equivalent control.
2. Visit every retained route at desktop and mobile widths.
3. Scroll through each page to trigger lazy loading.
4. Exercise menus, galleries, carousels, accordions, tabs, modals, video controls, and hover-triggered sections.
5. Collect failed requests, console errors, page errors, and performance.getEntriesByType('resource').
6. Reconcile runtime requests with the asset manifest and approved dependency ledger.

The result must show zero unapproved source-origin runtime requests.

10. Release the clone into visual QA

Only after the localization gate passes may the team begin side-by-side visual QA. If blocking the old origin changes fonts, icons, backgrounds, images, layout, scripts, interactions, or mobile rendering, return to localization. Do not document the failure as a visual-QA issue and continue.

Definition of done

The gate is complete only when:

• Every retained route builds.
• Every required asset appears in the asset manifest.
• Every localized asset exists in the repository and built output.
• CSS and JavaScript dependency discovery was recursive.
• Downloads pass file-type and content validation.
• Desktop and mobile source fragments were both checked.
• The source origin can be blocked without changing the rendered site or required interactions.
• The immutable preview makes zero unapproved source-origin runtime requests.
• Every remaining external runtime dependency has a purpose, owner, and approval record.
• npm run verify:clone-independence passes after the production build.
• Visual QA did not start before this gate passed.

A successful build alone is not a pass. A visually correct page that still depends on the old source is not a pass.