feat: finalize DGAF v1 governed control plane with TGL hardening

.github/workflows/control-plane-contract.yml

@@ -0,0 +1,73 @@
+name: DGAF v1 Control-Plane Contract
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "pptl/governance_envelope.py"
+      - "pptl/state_identity.py"
+      - "pptl/budget_ledger.py"
+      - "pptl/branch_registry.py"
+      - "pptl/control_plane.py"
+      - "pptl/commit_gate.py"
+      - "pptl/triadic_governance_loop.py"
+      - "pptl/tests/test_v1_control_plane.py"
+      - "pptl/tests/test_v1_tgl_integration.py"
+      - "pptl/tests/test_v1_adversarial_contract.py"
+      - "pptl/tests/test_v1_capability_boundaries.py"
+      - "docs/architecture/DGAF_V1_AGENT_ROLE_MAPPING.md"
+      - "docs/governance/DGAF_V1_FINALIZATION_GATE.md"
+      - "docs/architecture/DGAF_V1_EXECUTION_READINESS.md"
+      - "requirements-ci.txt"
+      - ".github/workflows/control-plane-contract.yml"
+  push:
+    branches:
+      - "feat/dgaf-v1-control-plane-finalize-20260829"
+    paths:
+      - "pptl/governance_envelope.py"
+      - "pptl/state_identity.py"
+      - "pptl/budget_ledger.py"
+      - "pptl/branch_registry.py"
+      - "pptl/control_plane.py"
+      - "pptl/commit_gate.py"
+      - "pptl/triadic_governance_loop.py"
+      - "pptl/tests/test_v1_control_plane.py"
+      - "pptl/tests/test_v1_tgl_integration.py"
+      - "pptl/tests/test_v1_adversarial_contract.py"
+      - "pptl/tests/test_v1_capability_boundaries.py"
+      - "requirements-ci.txt"
+      - ".github/workflows/control-plane-contract.yml"
+  workflow_dispatch:
+
+jobs:
+  contracts:
+    name: V1 Control-Plane Contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 1
+      - name: Assert exact candidate checkout
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          ACTUAL_SHA="$(git rev-parse HEAD)"
+          test "$ACTUAL_SHA" = "$EXPECTED_SHA"
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install pinned CI dependencies
+        run: python -m pip install -r requirements-ci.txt pandas==3.0.5
+      - name: Run deterministic contracts
+        run: >-
+          python -m pytest -q
+          pptl/tests/test_v1_control_plane.py
+          pptl/tests/test_v1_tgl_integration.py
+          pptl/tests/test_v1_adversarial_contract.py
+          pptl/tests/test_v1_capability_boundaries.py

.github/workflows/deploy.yml

@@ -70,6 +70,8 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       deployment_url: ${{ steps.deploy.outputs.deployment_url }}
+      deployment_id: ${{ steps.provenance.outputs.deployment_id }}
+      source_sha: ${{ steps.provenance.outputs.source_sha }}
     env:
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
@@ -95,25 +97,66 @@ jobs:
             --token="$VERCEL_TOKEN")
           echo "deployment_url=$URL" >> "$GITHUB_OUTPUT"
           echo "Deployed to: $URL"
-          export DEPLOYMENT_URL="$URL"
+
+      - name: Verify exact Vercel deployment identity
+        id: provenance
+        shell: bash
+        env:
+          DEPLOYMENT_URL: ${{ steps.deploy.outputs.deployment_url }}
+        run: |
+          set -euo pipefail
+          mkdir -p artifacts
+          HOST="${DEPLOYMENT_URL#https://}"
+          HOST="${HOST#http://}"
+          RESPONSE=$(curl -fsS --get \
+            --data-urlencode "teamId=$VERCEL_ORG_ID" \
+            --data-urlencode "withGitRepoInfo=true" \
+            "https://api.vercel.com/v13/deployments/$HOST" \
+            -H "Authorization: Bearer $VERCEL_TOKEN")
+
+          echo "$RESPONSE" > artifacts/deployment_metadata.json
+          READY_STATE=$(echo "$RESPONSE" | jq -r '.readyState // empty')
+          TARGET=$(echo "$RESPONSE" | jq -r '.target // empty')
+          DEPLOYMENT_ID=$(echo "$RESPONSE" | jq -r '.id // empty')
+          META_SHA=$(echo "$RESPONSE" | jq -r '.meta.githubCommitSha // empty')
+          GIT_SHA=$(echo "$RESPONSE" | jq -r '.gitSource.sha // empty')
+          SOURCE_SHA="${META_SHA:-$GIT_SHA}"
+
+          [ -n "$DEPLOYMENT_ID" ] || { echo 'x deployment id missing'; exit 1; }
+          [ "$READY_STATE" = "READY" ] || { echo "x deployment state=$READY_STATE"; exit 1; }
+          [ "$TARGET" = "production" ] || { echo "x deployment target=$TARGET; expected production"; exit 1; }
+          [ -n "$SOURCE_SHA" ] || { echo 'x Vercel Git source SHA missing'; exit 1; }
+          [ "$SOURCE_SHA" = "$GITHUB_SHA" ] || {
+            echo "x source SHA mismatch: Vercel=$SOURCE_SHA GitHub=$GITHUB_SHA"
+            exit 1
+          }
+
           python - <<'PY'
           import json
           import os
           from pathlib import Path
 
+          raw = json.loads(Path('artifacts/deployment_metadata.json').read_text(encoding='utf-8'))
+          source_sha = raw.get('meta', {}).get('githubCommitSha') or raw.get('gitSource', {}).get('sha')
           payload = {
-              'evidence_class': 'DEPLOYMENT_ATTESTATION',
+              'evidence_class': 'DEPLOYMENT_EXACT_SOURCE_ATTESTATION',
               'source_commit': os.environ['GITHUB_SHA'],
+              'vercel_source_commit': source_sha,
               'workflow_run_id': os.environ['GITHUB_RUN_ID'],
+              'deployment_id': raw.get('id'),
               'deployment_url': os.environ['DEPLOYMENT_URL'],
-              'command': 'vercel deploy --prod --yes --token=<redacted>',
-              'result': 'DEPLOYMENT_RETURNED_URL',
-              'scope': 'Vercel deployment command result only',
-              'limitations': ['Deployment return does not establish application health or end-to-end runtime behavior.'],
+              'ready_state': raw.get('readyState'),
+              'target': raw.get('target'),
+              'git_ref': raw.get('meta', {}).get('githubCommitRef') or raw.get('gitSource', {}).get('ref'),
+              'repository': raw.get('meta', {}).get('githubRepo'),
+              'exact_source_match': source_sha == os.environ['GITHUB_SHA'],
           }
           Path('artifacts/deployment_provenance.json').write_text(json.dumps(payload, indent=2) + '\n', encoding='utf-8')
           PY
 
+          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$SOURCE_SHA" >> "$GITHUB_OUTPUT"
+
       - name: Set env vars
         run: |
           echo "1.8.0" | vercel env add ENSEMBLE_VERSION production \
@@ -208,9 +251,9 @@ jobs:
               'source_commit': os.environ['GITHUB_SHA'],
               'workflow_run_id': os.environ['GITHUB_RUN_ID'],
               'deployment_url': os.environ['DGAF_URL'],
-              'scope': 'health preflight, 30-turn live regression, and audit turn-count check',
+              'scope': 'exact-source production deployment identity, health preflight, 30-turn live regression, and audit turn-count check',
               'result': 'PASS',
-              'limitations': ['Runtime verification applies to the exercised deployment and protocol; it does not establish broad real-world efficacy.'],
+              'limitations': ['Runtime verification applies to the exercised exact-source production deployment and protocol; it does not establish broad real-world efficacy.'],
           }
           Path('artifacts/runtime_verification.json').write_text(json.dumps(payload, indent=2) + '\n', encoding='utf-8')
           PY

.github/workflows/doc-lint-pr-scope.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install markdownlint-cli
         run: npm install -g markdownlint-cli@0.39.0

.github/workflows/doc-lint.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install markdownlint-cli
         run: npm install -g markdownlint-cli@0.39.0