ops: bound automatic Vercel previews to deploy-relevant changes

[ndrorchestration]

Purpose

Preserve the deployment-quota hygiene experiment that makes automatic Vercel preview skipping fail safe toward BUILD whenever deployment irrelevance is not proven.

Current disposition — 2026-09-15

DRAFT / HOLD / STALE-LINEAGE. DO NOT MERGE AS-IS.

Current protected main is 1fb2c665587d5a0e7b213aef1cc5c870097cdc9b. The former #665/quota-block context is historical; Track A has since completed its Epoch 002 blinded collection. The immediate critical path is now #679 retained-byte provenance → pre-lock ledger → dataset-lock evidence.

This branch's historical three-file delta remains:

• app/lib/vercel-ignore-build.test.ts
• scripts/vercel-ignore-build.mjs
• vercel.json

Historical validation does not transfer.

Because the active retained-byte evidence preparer binds to exact executing repository HEAD, do not reconcile or merge this operational lane before the #679 operator checkpoint. It is not a dataset-lock prerequisite.

Required design correction before reuse

Use default BUILD / narrow SKIP semantics.

Must force BUILD at minimum: app/**, api/**, public/** when present, middleware.ts/replacement runtime routing surface, vercel.json, package/lock files, Next/TypeScript/runtime configuration, scripts/vercel-ignore-build.mjs, and all unknown/unmatched root/runtime/config surfaces.

Initial SAFE-SKIP candidates should remain limited to explicitly proven-inert surfaces such as .github/**, docs/**, schemas/**, and tests/**. Do not grant blanket scripts/** skip authority. Missing/invalid SHA evidence, failed comparison, rename ambiguity, mixed inert+deploy-relevant diffs, empty/uncertain comparisons, or classifier uncertainty must force BUILD.

Required real acceptance experiment

When this lane is eventually reconstructed from then-current protected main:

1. prove a docs-only inert change yields the intended real Vercel ignored/skipped behavior and record its exact status semantics;
2. establish whether the ignored outcome consumes deployment quota in this project;
3. prove a deploy-relevant control change builds;
4. prove modifying the classifier itself forces BUILD;
5. prove mixed inert + deploy-relevant cumulative diffs force BUILD;
6. run fresh exact-head GitHub validation and require applicable external Vercel evidence.

Governance boundary

Operational deployment hygiene only. No dataset lock, unblinding, primary-analysis authority, efficacy, High-Assurance status, or scientific-N increment follows.

[vercel]

Deployment failed for project dynamicgovernanceagenticformation with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/ndrorchestration?upgradeToPro=build-rate-limit

[vercel]

Deployment failed for project dynamicgovernanceagenticformation with the following error:

Resource is limited - try again in 1 day (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/ndrorchestration?upgradeToPro=build-rate-limit

[ndrorchestration]

Post-#639 dependency checkpoint:

• Current accepted main is 8a436285ed7bacf94fcd2069d51ed82e9785dbc0 (feat(track-a): add fail-closed custody admission helper #639).
• This draft PR remains at exact head c512a6f95e5b74c03822d0558965e218616b2a3d, so it is now one main commit behind.
• Compare against current main shows no filename/content collision: this PR changes only app/lib/vercel-ignore-build.test.ts, scripts/vercel-ignore-build.mjs, and vercel.json; feat(track-a): add fail-closed custody admission helper #639 changed the Track A local setup doc plus its distinct custody-admission helper/test.
• The previously recorded 19/19 green exact-head wave remains valid only for c512a6f..., not for a future rebased/integrated candidate.

No rebase/integration is being pushed yet because PR #636's current exact-head wave is runner-queued; launching another full validation wave would add avoidable CI contention. Once #636 stabilizes, refresh #638 onto current main and require fresh exact-head evidence before any merge decision.

Operational boundary unchanged: preview-quota hygiene only; no scientific/governance transition.

[ndrorchestration]

Read-only parked-branch review against exact head 456a7c6d576454c20a23ba8c929e7f21298288f5 found two acceptance questions to resolve when this PR is eventually refreshed. No head change is requested now.

Important — deployment-control self-classification. SAFE_NON_DEPLOY_PREFIXES currently includes the entire scripts/ tree, while the active ignored-build decision program is itself scripts/vercel-ignore-build.mjs. A future change to this control-plane helper can therefore classify its own path as non-deploying. The helper fails safely on missing/invalid Git evidence, but a syntactically valid semantic regression in the helper is precisely the class of change that should not be assumed non-deploying. On refresh, narrow scripts/** to explicitly proven non-deploy subpaths/files or explicitly force-build for scripts/vercel-ignore-build.mjs and any build/deployment-control scripts.

Acceptance risk — ignored status vs DGAF merge policy. Current Vercel documentation confirms that ignoreCommand exit 0 ignores the build and that VERCEL_GIT_PREVIOUS_SHA is the SHA of the last successful deployment (only exposed with an Ignored Build Step). The cumulative diff behavior is conservative and appropriate. However, DGAF's standing policy currently requires terminal external Vercel success for acceptance. Before merging #638, deliberately verify on a non-deploy-only candidate that an ignored Vercel build produces the exact GitHub/Vercel status semantics the repository will accept; do not assume ignored/skipped is equivalent to success under that policy.

I would also keep docs/** / schemas/** on the skip list only after reconfirming they are not build/runtime inputs on the then-current app lineage. The current package.json build command is plain next build, but that alone is not a complete dependency proof.

These are operational hardening findings only. They do not affect #657, accepted freeze state, or scientific authority.

[ndrorchestration]

Platform-contract note for future reconciliation: Vercel ignoreCommand uses inverted exit semantics — exit code 0 means ignore/skip the build, while exit code 1 means continue the build. VERCEL_GIT_PREVIOUS_SHA is exposed when an Ignored Build Step is configured. The future #638 successor must therefore remain default-BUILD/fail-closed: uncertainty, invalid/missing SHA/history, mixed diffs, unmatched paths, or any classifier error must resolve to exit 1; only explicitly proven inert changes may return exit 0. This note does not activate #638 and does not substitute for #665 exact-head external evidence.

[ndrorchestration]

2026-09-15 post-#715 reassessment — preserve, do not revive as-is

Fresh reassessment against protected main ffb197443b02d49bffc8967f3cec1df72da560e8 confirms this historical branch should not be merged or simply rebased unchanged.

Two concrete gaps are now established:

1. The preserved helper currently includes blanket scripts/ in SAFE_NON_DEPLOY_PREFIXES. That contradicts ops: bound automatic Vercel previews to deploy-relevant changes #637's current fail-safe contract because repository scripts can affect deployment/runtime behavior. Current reconstruction must treat scripts/** as BUILD by default, with the classifier itself explicitly BUILD-critical.
2. vercel.json ignoreCommand addresses Vercel Git-integration preview/build suppression, but it would not have prevented today's exact-main GitHub Actions production failure. Push run 35018904684 invoked vercel deploy --prod directly and was blocked by api-deployments-free-per-day after configuration and upload succeeded.

A current reconstruction therefore needs one conservative classifier reused by both:

• Vercel Git-integration ignoreCommand; and
• the GitHub production deployment workflow before invoking vercel deploy --prod.

The intended contract remains default BUILD / narrow proven-inert SKIP. Initial skip set: .github/**, docs/**, schemas/**, tests/**, with explicit BUILD exceptions for deployment-control files such as .github/workflows/deploy.yml; all scripts/**, runtime/app/API/public/package/lock/config surfaces, unknown paths, missing/invalid comparison SHAs, rename ambiguity, empty/uncertain comparisons, and mixed inert+deploy-relevant diffs force BUILD.

This comment is design/audit provenance only. No current-main implementation has been created from this stale branch yet, and historical validation does not transfer.

[ndrorchestration]

Superseded by current-main reconstruction #717.

#717 implements the corrected default-BUILD / narrow-SKIP contract from protected main ffb197443b02d49bffc8967f3cec1df72da560e8, removes this stale branch's unsafe blanket scripts/** skip behavior, and additionally gates the GitHub Actions production deploy path with the same fail-closed classifier. Its exact-head repository verification is green; external Vercel acceptance is currently quota-blocked and #717 remains DRAFT/HOLD.

This PR is therefore obsolete as an implementation lane. Closed unmerged; preserve branch/history as provenance and do not delete the ref merely because the PR is closed.