feat: Add a bounded GET-only console version comparator

.github/workflows/compare-console-versions.yml

@@ -0,0 +1,50 @@
+name: Compare Console Versions (GET only)
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_commitment:
+        description: SHA-256 commitment of the exact candidate reference
+        required: true
+        type: string
+      baseline_mode:
+        description: Evidence source for the baseline
+        required: true
+        type: choice
+        options: [saved, derived, none]
+        default: none
+      baseline_commitment:
+        description: SHA-256 commitment (required only for saved mode)
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: console-version-comparator
+  cancel-in-progress: false
+
+jobs:
+  compare:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: runtime-strategy-switch
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      - name: Compare bounded metadata
+        env:
+          CANDIDATE_COMMITMENT: ${{ inputs.candidate_commitment }}
+          BASELINE_MODE: ${{ inputs.baseline_mode }}
+          BASELINE_COMMITMENT: ${{ inputs.baseline_commitment }}
+          RO_COMPARATOR_EXECUTOR_SHA: ${{ vars.RO_COMPARATOR_EXECUTOR_SHA }}
+          CLOUDFLARE_WORKER_NAME: ${{ secrets.CLOUDFLARE_WORKER_NAME }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_READ_ONLY_API_TOKEN: ${{ secrets.CLOUDFLARE_READ_ONLY_API_TOKEN }}
+        run: node scripts/console_version_comparator.mjs

docs/console-execution-evidence.md

@@ -44,3 +44,49 @@ This mode requires `release_frontend_assets=true`, `sync_secrets=false`,
 exclude backend-only, rollback, private-release and read-only modes. An arbitrary
 main commit is not an accepted release source. Deployment still requires separate
 scoped authorization; accepting a source does not grant deployment authority.
+
+
+### Manual version comparison (GET only)
+
+`compare-console-versions.yml` is a separate, manual-only evidence executor. It
+never uploads, activates or changes a candidate. A reviewed and merged executor
+is a prerequisite, not permission to run it. A separate read-only card must bind
+its exact revision, candidate commitment and baseline choice, with at most six
+GET requests. No execution or Environment approval is implied by this document.
+
+Inputs are SHA-256 commitments of the exact UTF-8 provider references, with no
+trimming or case conversion. `saved` requires a baseline commitment; `derived`
+uses the newest deployment before the incident start, cross-checked against the
+version immediately preceding the candidate on page one; `none` produces partial
+candidate evidence. Missing derived evidence also produces partial evidence.
+A missing saved baseline stops. Derivation never recovers an original saved
+baseline. No pagination or retry is permitted.
+
+The Environment must supply a dedicated read-only credential through
+`CLOUDFLARE_READ_ONLY_API_TOKEN`, the existing Secret-backed account binding,
+`CLOUDFLARE_WORKER_NAME` as a Secret-backed Worker binding, and
+`RO_COMPARATOR_EXECUTOR_SHA` matching the card's executor revision. Their
+availability and Environment review policy are unverified; provisioning or
+changing bindings needs separate authority. The deploy-capable token is not
+used. Account variables are not used as a fallback because runner step headers
+can print ordinary variables before the executor starts. Missing account or Worker Secrets
+stop before any GET. Worker names must be 1–63 lowercase letters, digits or
+hyphens, starting and ending with a letter or digit; invalid names stop before
+URL construction. Checkout runs at the dispatch revision and does not persist credentials.
+The required SG egress route and guard must be verified independently before any
+future dispatch; hosted-runner egress is not established by this change.
+
+The fixed request order is deployments, version list, candidate, optional
+baseline, candidate again, deployments again. Reads stop on schema, identity,
+transport, size, timeout or drift failures. Each response is capped at 512 KiB,
+with a six-GET / 3 MiB / 120-second ceiling. There is no persistent result cache
+or resume path. Concurrent observations are separate; window drift fails.
+
+The output contains only fixed keys, enum kinds, booleans and the executor SHA.
+Bindings and runtime groups expose equality booleans, never names, values or
+provider references. Configuration equality uses the release workflow's exact
+canonicalization, comparable projection and migration-tag normalization; etag
+equality is emitted separately. Node major 22 is selected. Historical ICU and
+`localeCompare` compatibility remain unproven. Secret metadata equality does not
+prove secret-value equality. A stable read window does not prove historical
+inactivity, recover transient conditions or authorize candidate reuse.