ops: share fail-closed Vercel deploy quota guard

[ndrorchestration]

Purpose

Reconstruct #637 from current protected main after fresh evidence that the Vercel Hobby api-deployments-free-per-day quota affects the GitHub Actions production deploy path as well as automatic previews.

This PR is operational/deployment hygiene only. It does not alter scientific state, materialization authority, primary-analysis authority, empirical N, efficacy, or High-Assurance state.

Current validation checkpoint

Refreshed onto accepted #718 main 0e0e1a67644be224de3212a4aea83e191de41f23.
Current head: b872143c0aa93ed6c5b4803d9d623298bed05b57.
The comparison against that baseline retains exactly the original four-file scope. Fresh CI and external exact-head staging evidence are required; earlier green results do not transfer. DRAFT / HOLD remains in effect.

Original implementation scope (historical)

Base: signed/verified protected main ffb197443b02d49bffc8967f3cec1df72da560e8.

Current exact head: e87feb91499fe93cd7157aa6fdcd6c501960d757.

Exactly four files differ from the base:

1. .github/workflows/deploy.yml
2. app/lib/vercel-deploy-quota-guard.test.ts
3. scripts/vercel-ignore-build.mjs
4. vercel.json

TDD evidence

The initial test-only commit 8fcebceb3b2c0cfc83a00d1881eb32a35d21d19b exposed a test-harness import mistake and is retained only as failed test-development provenance.

The corrected test-only RED commit is eaa630fe0959aae6e4a35473b1bc1f5136c03798. UI validation run 35024476686 then failed 7 intended new tests because scripts/vercel-ignore-build.mjs did not exist and neither deployment path was wired to the classifier.

Production implementation followed only after that valid RED.

Implemented contract

One fail-closed classifier now drives both Vercel Git-integration ignore behavior and the GitHub Actions production-deploy preflight.

SAFE-SKIP is restricted to .github/**, docs/**, schemas/**, and tests/**, with .github/workflows/deploy.yml explicitly forced to BUILD. All scripts/**, runtime/application surfaces, deployment/config/package surfaces, unknown paths, empty/uncertain comparisons, invalid/missing SHAs, runtime renames, and mixed inert+deploy-relevant diffs BUILD.

The helper uses git diff --name-only -z --no-renames so a runtime source moved into an inert destination cannot disappear behind rename collapsing. Missing or invalid comparison evidence fails closed toward BUILD.

vercel.json uses the same helper as ignoreCommand. The production deployment workflow first classifies the exact main-push diff and only invokes Vercel when the decision is BUILD; workflow-dispatch/missing comparison evidence defaults to BUILD.

The stale #638 implementation remains provenance only and is not reused as accepted code because it allowed blanket scripts/** skipping and did not gate the GitHub Actions production deployment.

Historical implementation-head repository verification

For e87feb91499fe93cd7157aa6fdcd6c501960d757, all repository-controlled pull-request workflow families are terminal SUCCESS, including:

• UI semantic/contract tests and production Next.js build
• Python 3.10 / 3.11 / 3.12 quality + pytest
• security scan and deterministic staging-evidence harness
• Governance CI, including E2b/M6, P-42/P8, authority/Layer-0, TLA+ pin and containment model checking
• PDMAL Harness and PDMAL Pre-Freeze Runner Validation
• PPTL CI
• DGAF Regression Suite
• Truth Layer Tests + Validation
• Epistemic Evidence Validation
• Claim Hygiene and IP Hygiene
• Control-State Consistency and HEAD binding
• Full Repository Coverage Audit
• Critical PR Lane Custody
• Propagation Consistency and Vocabulary Translation Matrix
• PR Issue-State Keyword Guard, including the metadata-triggered rerun

External Vercel acceptance blocker

Exact-source Live Staging Breaker run 35024680218 checked out and proved exact source e87feb91499fe93cd7157aa6fdcd6c501960d757, installed the pinned Vercel CLI, validated both credentials, bound the attempt identity, and uploaded the 16.3 KB preview payload. Vercel then rejected deployment creation with:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Therefore:

• repository implementation verification = PASS;
• external exact-source Vercel acceptance = NOT VERIFIED / BLOCKED BY QUOTA;
• the failed staging workflow is retained as external-quota provenance, not reclassified as a source/test failure;
• no exact-source preview deployment object or live breaker exercise was admitted.

PR disposition remains DRAFT / HOLD / DO NOT MERGE until fresh exact-head external Vercel staging evidence succeeds after quota recovery. Do not substitute an older deployment or cross-head evidence.

Boundary

No deployment success is claimed. Current scientific state remains unchanged:

• MATERIALIZATION = NOT_ESTABLISHED
• PRIMARY_ANALYSIS = NOT_AUTHORIZED / NOT_RUN
• SCIENTIFIC_N_INCREMENT = 0
• CANONICAL_DGAF_EFFICACY = NOT_ESTABLISHED
• INDEPENDENT_VALIDATION = NOT_ESTABLISHED
• broader High-Assurance = PRE-FREEZE / FAIL-CLOSED / NOT AUTHORIZED / N=0

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dynamicgovernanceagenticformation	Ready	Preview	Sep 16, 2026 5:23am UTC

[vercel]

Deployment failed for project dynamicgovernanceagenticformation with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/ndrorchestration?upgradeToPro=build-rate-limit

[ndrorchestration]

Repository-controlled verification for exact head e87feb91499fe93cd7157aa6fdcd6c501960d757 is complete and green. External Vercel exact-source staging remains NOT VERIFIED solely because run 35024680218 was rejected after upload by api-deployments-free-per-day. Preserve DRAFT/HOLD; do not merge until a fresh exact-head external staging run succeeds after quota recovery. No scientific/control-state transition is implied.

[ndrorchestration]

No code changes are requested while the external Vercel quota is active. This PR should remain at exact head e87feb91499fe93cd7157aa6fdcd6c501960d757; cross-head or older deployment evidence must not be substituted.

[ndrorchestration]

Current disposition remains implementation PASS / external exact-source Vercel acceptance NOT VERIFIED due quota. Holding this line intentionally prevents an operational hygiene PR from weakening its own exact-head evidence standard.

[ndrorchestration]

I am now advancing the independent Track A operator-materialization handoff under #523; this does not alter #717's draft/hold status or scientific state.

[ndrorchestration]

Repository-only work is now exhausted on the quota-guard lane until fresh Vercel capacity exists; no merge or rerun is justified right now.

[ndrorchestration]

Superseded after accepted #716 moved protected main to cc557ec290b0054929d35156c86397da809581be. The old exact head b872143c0aa93ed6c5b4803d9d623298bed05b57 ultimately achieved terminal-success repository CI plus Live Staging Breaker run 35059268081; that evidence remains valid historical provenance for that head only. The same bounded four-file effective delta has been reconstructed from current protected main as draft PR #721. No prior-head validation transfers; #721 requires fresh exact-head CI and live staging evidence.