Harden clinical-notes trust gating and finish audit remediations

eslint-rules/require-z-index-ladder.mjs

@@ -0,0 +1,55 @@
+/**
+ * Local ESLint rule: enforce z-index ladder allowed rungs.
+ * Validates all z-[<n>] utilities against allowed rungs:
+ * 0, 5, 10, 20, 30, 40, 60, 80-85, 95, 100
+ *
+ * Rung 5 is reserved for interstitial chrome that must sit above a z-0
+ * backdrop but below the z-10 command/suggestion surface (privacy notice).
+ */
+
+const ALLOWED_RUNGS = new Set([0, 5, 10, 20, 30, 40, 60, 80, 81, 82, 83, 84, 85, 95, 100]);
+
+/** @type {import("eslint").Rule.RuleModule} */
+const rule = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Enforce z-index ladder allowed rungs.",
+    },
+    schema: [],
+    messages: {
+      invalid: "Z-index value z-[{{value}}] is not allowed. Allowed rungs: 0, 5, 10, 20, 30, 40, 60, 80-85, 95, 100.",
+    },
+  },
+  create(context) {
+    const checkString = (node, value) => {
+      const regex = /\bz-\[(\d+)\](?:\s|$)/g;
+      let match;
+      while ((match = regex.exec(value)) !== null) {
+        const num = parseInt(match[1], 10);
+        if (!ALLOWED_RUNGS.has(num)) {
+          context.report({
+            node,
+            messageId: "invalid",
+            data: { value: match[1] },
+          });
+        }
+      }
+    };
+
+    return {
+      Literal(node) {
+        if (typeof node.value === "string") {
+          checkString(node, node.value);
+        }
+      },
+      TemplateElement(node) {
+        if (typeof node.value.raw === "string") {
+          checkString(node, node.value.raw);
+        }
+      },
+    };
+  },
+};
+
+export default rule;

eslint.config.mjs

@@ -4,6 +4,7 @@ import nextTs from "eslint-config-next/typescript";
 
 import requireLucideIconAria from "./eslint-rules/require-lucide-icon-aria.mjs";
 import requireButtonWiring from "./eslint-rules/require-button-wiring.mjs";
+import requireZIndexLadder from "./eslint-rules/require-z-index-ladder.mjs";
 import restrictSuppressHydrationWarning from "./eslint-rules/restrict-suppress-hydration-warning.mjs";
 import noHardcodedHex from "./eslint-rules/no-hardcoded-hex.mjs";
 
@@ -14,6 +15,7 @@ const localRulesPlugin = {
   rules: {
     "require-lucide-icon-aria": requireLucideIconAria,
     "require-button-wiring": requireButtonWiring,
+    "require-z-index-ladder": requireZIndexLadder,
     "restrict-suppress-hydration-warning": restrictSuppressHydrationWarning,
     "no-hardcoded-hex": noHardcodedHex,
   },
@@ -78,6 +80,15 @@ const eslintConfig = defineConfig([
       "local/restrict-suppress-hydration-warning": "error",
     },
   },
+  // Z-index ladder enforcement
+  {
+    files: ["src/**/*.{js,jsx,ts,tsx}"],
+    ignores: MOCKUP_IGNORES,
+    plugins: { local: localRulesPlugin },
+    rules: {
+      "local/require-z-index-ladder": "error",
+    },
+  },
   // Import boundary: production source must not import design-scratch mockup
   // modules. Every legitimate mockup import lives under `src/app/mockups/**` (all
   // 404 in production) or inside the `*-mockups` component sources themselves;