feat(build): proofloop-build-sha meta + post-deploy readback

[HomenShum]

Summary

• Node Foyer's deployGate: live-dom requires a product's own deploy workflow to read its live identity back. NodeProof/proofloop had none — registry/adapters.json in node-foyer only has a reachable-only health check for it (/api/hosted/health).
• Adds scripts/stamp-build-sha.mjs, wired into npm run build (tsc -p tsconfig.json && node scripts/stamp-build-sha.mjs), which stamps exactly one <meta name="proofloop-build-sha" content="<sha>" data-provenance="commit"> into public/index.html. Precedence: VERCEL_GIT_COMMIT_SHA, then GITHUB_SHA, then git rev-parse HEAD, else content="unavailable" data-provenance="unavailable". Idempotent — strips any prior stamp before inserting, so pretest re-running build never duplicates the tag.
• Adds .github/workflows/deploy-verify.yml (on: deployment_status) that polls https://proofloop.live/ for up to 3 minutes after a production deploy succeeds, failing if the live meta never equals github.event.deployment.sha.
• Adds tests/stampBuildSha.test.ts (3 cases: sha injected once, unavailable provenance, idempotent re-stamp).

STEP 1 — establishing the deploy source (required before any code change)

Two local clones exist that looked like candidates: D:/VSCode Projects/proofloop (origin github.com/HomenShum/proofloop.git) and D:/VSCode Projects/cafecorner_nodebench/nodebench_ai4/NodeProof (origin github.com/HomenShum/NodeProof.git). Evidence shows these are the same GitHub repository, not two competing ones:

$ gh api repos/HomenShum/proofloop -q '.full_name, .html_url, .fork'
HomenShum/NodeProof
https://github.com/HomenShum/NodeProof
false

HomenShum/proofloop is a pre-rename name that GitHub transparently redirects to HomenShum/NodeProof (same repo id 1288678020 on every deployments call regardless of which name was queried — gh api repos/HomenShum/proofloop/deployments and gh api repos/HomenShum/NodeProof/deployments return byte-identical JSON, all repository_url fields say NodeProof). The D:/VSCode Projects/proofloop clone is simply stale — its origin uses the old pre-rename URL and its HEAD (8532ab3, 2026-07-07) is ~2 months behind; it is not a second deploy source.

Confirmed which commit production actually serves, three independent ways:

$ vercel inspect https://proofloop.live
  id      dpl_5Q8cssTPTUcvZRLUe1eAEmkKQiBd
  name    proofloop
  target  production
  status  ● Ready
  url     https://proofloop-rdfihk78k-hshum2018-gmailcoms-projects.vercel.app
  created Fri Sep 04 2026 20:15:09 GMT-0700 (8d ago)
  Aliases: https://proofloop.live, https://www.proofloop.live, ...

$ gh api repos/HomenShum/NodeProof/deployments/6276537345/statuses -q '.[0] | {state, environment, target_url}'
{"state":"success","environment":"Production","target_url":"https://proofloop-rdfihk78k-hshum2018-gmailcoms-projects.vercel.app"}
# same deployment (byte-identical vercel.app URL), sha e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d, repo HomenShum/NodeProof

$ cd "D:/VSCode Projects/cafecorner_nodebench/nodebench_ai4/NodeProof" && git rev-parse origin/main
e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d   # == the sha production is serving right now

gh api repos/HomenShum/NodeProof/deployments?per_page=10 shows every production deploy's environment as the bare string "Production" (8 of 8 sampled) — no sibling Vercel project shares this repo, so deploy-verify.yml's condition is a plain equality check (no contains(...) name filter needed, unlike NodeVoice PR #10 which shares its repo with local-collab-mvp).

Established deploy source: HomenShum/NodeProof (the repo's own package.json name is "proofloop", and the live /api/hosted/health self-report — {"owner":"HomenShum","repo":"proofloop", ...} — is that same hardcoded config string, not a different physical repo). Per the task instruction, the meta tag uses the health-reported product name: proofloop-build-sha.

public/index.html is a static file — vercel.json's buildCommand is npm run build / outputDirectory is public, and before this PR npm run build was tsc -p tsconfig.json only (never touched public/). No framework/bundler owns the HTML, hence the plain Node stamp script instead of a Vite plugin.

Local proof

$ npm install --no-audit --no-fund
added 51 packages in 4s

$ npm run build
> tsc -p tsconfig.json && node scripts/stamp-build-sha.mjs
stamp-build-sha: wrote proofloop-build-sha=e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d to public/index.html

$ grep -o '<meta name="proofloop-build-sha"[^>]*>' public/index.html
<meta name="proofloop-build-sha" content="e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d" data-provenance="commit" />

$ grep -c '<meta name="proofloop-build-sha"' public/index.html
1

$ git rev-parse HEAD
e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d

Exactly one tag, content equal to the checkout sha (no VERCEL_GIT_COMMIT_SHA/GITHUB_SHA set locally, fell through to git rev-parse).

Served proof (this repo's own scripts/serve-public.mjs, the one local server it measures itself through):

$ node -e "import('./scripts/serve-public.mjs').then(async ({startPublicServer}) => {
  const { base, close } = await startPublicServer(4713);
  const res = await fetch(base + '/');
  console.log('SERVED_META:', (await res.text()).match(/<meta name=\"proofloop-build-sha\"[^>]*>/)[0]);
  await close();
});"
SERVED_META: <meta name="proofloop-build-sha" content="e45f90f692c59f4f86dd8a4343d42b9e1c03bd0d" data-provenance="commit" />

Repo's own checks (matches .github/workflows/ci.yml)

$ npm test          # pretest reruns build first
Test Files  29 passed (29)
     Tests  268 passed (268)

$ node dist/cli.js gate
proofloop gate: PASSED
  checks:
    - [pass] build (2448ms)
    - [pass] tests (16809ms)

$ node dist/cli.js help    # exit 0
$ node dist/cli.js doctor  # exit 0
$ node dist/cli.js prompt > /dev/null  # exit 0

Secret scan

git diff --cached grepped for sk-, api-key/token/secret patterns, BEGIN PRIVATE KEY, .env, .codex/config.toml, .vercel/ before push — the only hit was a false positive (process.env.VERCEL_GIT_COMMIT_SHA contains the substring .env); no real secret-like content in the diff.

Test plan

• npm install (fresh worktree cut from origin/main)
• npm run build then grep the meta tag in public/index.html
• Served public/index.html locally via scripts/serve-public.mjs and confirmed the meta tag round-trips
• npm test (268/268) and node dist/cli.js gate (PASSED) green
• CI (ci.yml) green on this PR
• After merge + a real Vercel production deploy, confirm deploy-verify.yml runs on the deployment_status event and passes

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
proofloop	Ready	Preview	Sep 13, 2026 1:08am UTC