From 0f76221997aa9e06ef374dd5c6aefed1d0f83791 Mon Sep 17 00:00:00 2001
From: Brooks Roley <brooksroley@gmail.com>
Date: Mon, 14 Sep 2026 19:46:28 -0700
Subject: [PATCH] ci(hardwood): guard vendored bundle with provenance file + PR
 check

Add public/hardwood/SOURCE_COMMIT.txt recording that the deployed bundle is
the "July monolith" build (restored in e99e60e; BballTactics source f7b01e3
per project memory). Add a pull_request-only CI step that fails when any
public/hardwood/ file changes without also bumping SOURCE_COMMIT.txt, so a
stale bundle like PR #43 can't ship silently again.

Claude-Session: https://claude.ai/code/session_01Vw2vZeTuaUDVaCvvRk1NME
---
 .github/workflows/ci.yml          | 24 ++++++++++++++
 public/hardwood/SOURCE_COMMIT.txt | 52 +++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 public/hardwood/SOURCE_COMMIT.txt

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5fdf338..8ebdc47 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,30 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Guard vendored Hardwood bundle provenance
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          # The public/hardwood/ bundle is a VENDORED build from the separate
+          # BballTactics repo. A stale bundle shipped once (PR #43) and had to be
+          # reverted same-day. Any PR that changes the bundle must also bump
+          # public/hardwood/SOURCE_COMMIT.txt so provenance never drifts.
+          git fetch --no-tags --depth=1 origin "$GITHUB_BASE_REF"
+          CHANGED="$(git diff --name-only "origin/${GITHUB_BASE_REF}...HEAD")"
+          BUNDLE_CHANGED="$(echo "$CHANGED" | grep -E '^public/hardwood/' | grep -v -E '^public/hardwood/SOURCE_COMMIT\.txt$' || true)"
+          SOURCE_CHANGED="$(echo "$CHANGED" | grep -E '^public/hardwood/SOURCE_COMMIT\.txt$' || true)"
+          if [ -n "$BUNDLE_CHANGED" ] && [ -z "$SOURCE_CHANGED" ]; then
+            echo "::error::Hardwood bundle changed but public/hardwood/SOURCE_COMMIT.txt was NOT updated."
+            echo "The public/hardwood/ bundle is vendored from the separate BballTactics repo."
+            echo "Files changed under public/hardwood/ in this PR:"
+            echo "$BUNDLE_CHANGED" | sed 's/^/  - /'
+            echo ""
+            echo "FIX: edit public/hardwood/SOURCE_COMMIT.txt to record the BballTactics"
+            echo "source SHA (and date) this bundle was built from, then commit it in this PR."
+            exit 1
+          fi
+          echo "Hardwood bundle provenance guard passed."
+
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
diff --git a/public/hardwood/SOURCE_COMMIT.txt b/public/hardwood/SOURCE_COMMIT.txt
new file mode 100644
index 0000000..2f95012
--- /dev/null
+++ b/public/hardwood/SOURCE_COMMIT.txt
@@ -0,0 +1,52 @@
+Hardwood Autochess — vendored bundle provenance
+=================================================
+
+WHAT THIS FILE IS FOR
+---------------------
+The game bundle in this directory (engine.js, engine.wasm, engine_roster.json,
+index.html, assets/) is NOT built here. It is compiled in a separate repo
+(BballTactics — Vue 3 + a C++ engine compiled to WASM) and copied in as built
+artifacts. This file records which source build the currently-deployed bundle
+came from, so the next person who rebuilds it can reproduce it and knows what
+they are replacing. A stale/mismatched bundle already shipped once (PR #43) and
+had to be reverted the same day; CI now fails a PR that touches these files
+without also bumping this file, so KEEP THIS FILE HONEST AND CURRENT.
+
+CURRENTLY-DEPLOYED BUNDLE
+-------------------------
+zero-next commit that restored/vendored this bundle:
+  e99e60e  revert(hardwood): restore July-monolith bundle (undo #43 regression)
+           Tue Sep 8 2026 — reverts PR #43, restoring the bundle originally
+           vendored in commit aeb7fce ("feat(hardwood): serve the game
+           same-origin at /hardwood", 2026-07-10).
+
+Build identity:
+  This is the "July monolith" build of BballTactics.
+
+BballTactics source SHA (recorded provenance, per zero-next project memory):
+  f7b01e3  "Push to actions and github pages" (2026-07-10) — the BballTactics
+           origin/main monolith rewrite that the deployed /hardwood bundle was
+           built from.
+
+  NOTE: f7b01e3 is the provenance RECORDED IN PROJECT MEMORY, not a SHA verified
+  against the BballTactics repo during the creation of this file. If you cannot
+  confirm this exact upstream build SHA against BballTactics origin/main, treat
+  it as:
+      BballTactics source SHA: UNKNOWN — record on next rebuild
+
+HOW TO REBUILD / RE-SYNC (and what to update here)
+--------------------------------------------------
+In BballTactics: git fetch, then build from CURRENT origin/main (the canonical
+build is the July monolith line, not the older May base):
+
+  vite build --base=/hardwood/ --outDir dist-hardwood
+
+The --base=/hardwood/ matters: dynamic-import chunks bake the base into their
+load URLs, so rewriting index.html alone is not enough once code is split.
+Copy index.html + assets/* (and engine.js/engine.wasm/engine_roster.json only if
+they actually changed — the two repos' engine files differ) into this directory.
+
+When you do, UPDATE THIS FILE with:
+  - the exact BballTactics commit SHA you built from (git rev-parse HEAD there)
+  - the date
+  - the zero-next commit/PR that vendored the new bundle