[anth-volk]

Fixes #9

Stacked on #1. This PR adopts the org's two-pass push workflow, matching policyengine-core and PolicyEngine/microcosm-emitter. It must merge into #1's branch before #1 merges. Otherwise Vercel's Git integration deploys main to production on #1's merge, and the checks don't gate that deploy.

Changes

• push.yaml runs twice per merge to main:
  1. On the merge commit, versioning bumps package.json from the fragment types: a major bump for breaking, a minor bump for added or removed, and a patch bump otherwise. It builds CHANGELOG.md with towncrier and commits "Update microcosm-runs" using the PolicyEngine GitHub App token. That push starts the second run, and the app bypasses the main ruleset.
  2. On that commit: verify (all of ci.yml), then tag (bare version, rerun-safe), then deploy. The deploy job runs vercel pull → vercel build --prod → vercel deploy --prebuilt --prod, then checks the public homepage. Each step waits for the one before, and only one production deploy runs at a time.
• pr.yaml: actionlint, a typed changelog-fragment check, and ci.yml, aggregated into Required checks.
• ci.yml: the existing format, lint, typecheck, test and build steps, now only as a reusable workflow.
• vercel.json: git.deploymentEnabled.main: false. PR previews still deploy.
• Also: towncrier.toml (copied from ui-kit), changelog.d/, and a README "Releases" section. The manual vercel --prod instruction is removed.

Credentials and settings

Used by	Provider	Wiring
versioning: APP_ID, APP_PRIVATE_KEY	Org Actions secrets, visible to all repos; the app is installed on all org repos	Read directly in push.yaml
tag: GITHUB_TOKEN	Actions	contents: write on that job only
deploy: VERCEL_TOKEN	Secret in the GitHub Production environment (allows only main)	environment: Production, passed to the deploy step's env
deploy: VERCEL_ORG_ID, VERCEL_PROJECT_ID	Literal job env (not secret; same pattern as calibration-diagnostics)	Read by the Vercel CLI
Build and runtime: BLOB_STORE_ID, BLOB_READ_WRITE_TOKEN, VERCEL_OIDC_TOKEN	Vercel project Production environment (set and managed by Vercel)	Brought into the build by vercel pull --environment=production; injected at runtime by Vercel

ORRERY_COLLECTOR_ORIGIN is unset in production, so the app uses its built-in production collector. MICROCOSM_RUNS_LOCAL_DIR is unset, as production requires.

The main ruleset currently requires a check named checks. It needs to change to Required checks before #1 can merge.

Validation (local, macOS)

• actionlint, shellcheck, format:check, lint, typecheck, bun test (28 pass) and bun run build all passed.
• Rehearsal in a throwaway clone with a local bare remote:
  • .github/update-version.sh produced 0.2.0 and collected the fragment into CHANGELOG.md.
  • The generated changelog passes format:check, and bun install --frozen-lockfile still passes.
  • .github/publish-git-tag.sh pushed 0.2.0, and a rerun reported it as existing.
• Not exercised: the GitHub App push and the Vercel deploy. Both first run when Publish immutable Orrery graphs and render run visualizations #1 merges to main.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
microcosm-runs	Ready	Preview	Oct 14, 2026 4:43pm UTC