feat(build): nodevoice-build-sha meta + post-deploy readback

[HomenShum]

Summary

• Adds a Vite plugin (adapted from node-foyer/vite.config.ts's foyer-build-sha provenance) that stamps exactly one <meta name="nodevoice-build-sha" content="<sha>" data-provenance="commit"> into the built index.html. Precedence: VERCEL_GIT_COMMIT_SHA, then GITHUB_SHA, then git rev-parse HEAD. Non-strict — falls back to content="unavailable" data-provenance="unavailable" rather than throwing when no signal is available (unlike node-foyer's strict-in-production variant).
• Adds .github/workflows/deploy-verify.yml (on: deployment_status) that polls https://nodevoice.vercel.app/ up to 3 minutes after a production deploy succeeds and fails the check if the live meta never equals the deployed commit sha.

This is the products worker's Task 2 for FOYER-V2 (Node Foyer's deployGate: live-dom requires a product's own deploy workflow to read its live identity back; NodeVoice currently has none — registry/adapters.json in node-foyer only has a text-presence check for it).

Event-shape evidence (gh api)

This repo has two Vercel projects deploying from it. gh api repos/HomenShum/NodeVoice/deployments?per_page=5 shows the nodevoice project's production environment name is not a bare "Production":

{"environment":"Production – local-collab-mvp", ...}
{"environment":"Production – nodevoice", ...}

and the matching status carries a real environment_url:

{"state":"success","environment":"Production – nodevoice","environment_url":"https://nodevoice-76v1rlbr5-hshum2018-gmailcoms-projects.vercel.app"}

So the workflow's job condition filters on startsWith(environment, 'Production') && contains(environment, 'nodevoice') instead of an exact "Production" match, so the sibling local-collab-mvp project's deploys don't gate this check.

Local proof

$ npm install --no-audit --no-fund
added 104 packages in 14s

$ npm run build
✓ built in 19.16s

$ grep -o '<meta name="nodevoice-build-sha"[^>]*>' dist/index.html
<meta name="nodevoice-build-sha" content="5de08a1ce45cc282ff58099c82bad7d10a284ebf" data-provenance="commit">

$ grep -c '<meta name="nodevoice-build-sha"' dist/index.html
1

$ git rev-parse HEAD
5de08a1ce45cc282ff58099c82bad7d10a284ebf

Exactly one tag, content equal to the checkout sha (no VERCEL_GIT_COMMIT_SHA/GITHUB_SHA set locally, so it fell through to git rev-parse).

$ npm run check:client
tsc --noEmit -p tsconfig.client.json
(exit 0, no output)

Test plan

• npm install (fresh clone)
• npm run build then grep the meta tag in dist/index.html
• npm run check:client typecheck green
• CI (ci.yml, node-platform-conformance.yml) green on this PR
• After merge + a real Vercel production deploy, confirm deploy-verify.yml runs and passes on the deployment_status event

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
local-collab-mvp	Ready	Preview	Sep 12, 2026 7:21pm UTC
nodevoice	Ready	Preview	Sep 12, 2026 7:21pm UTC