From a9e05a66e7eb941c28526813f2ba781f5881f8d7 Mon Sep 17 00:00:00 2001 From: alexruidan <41616537+xLagerFeuer@users.noreply.github.com> Date: Thu, 12 Nov 2026 01:35:20 +0300 Subject: [PATCH 1/5] site: render source-verified Upstream merged changes with exact evidence links --- scripts/sync-vsm-oss-metrics.cjs | 48 +++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/scripts/sync-vsm-oss-metrics.cjs b/scripts/sync-vsm-oss-metrics.cjs index ab409c6..71790ca 100644 --- a/scripts/sync-vsm-oss-metrics.cjs +++ b/scripts/sync-vsm-oss-metrics.cjs @@ -79,6 +79,50 @@ if (snapshot.publication.engineering_activity_is_productivity_kpi !== false) { throw new Error('Engineering activity must remain non-KPI'); } +function verifiedUpstreamEvidence(snapshot) { + const owner = snapshot.repositories['opensiro/upstream']; + const outcome = owner && owner.metrics && owner.metrics.verified_external_outcomes; + if (!outcome || outcome.value == null) return ''; + const records = outcome.accepted; + if (!Number.isSafeInteger(outcome.value) || outcome.value < 0 + || outcome.claim_status !== 'verified_merged_changes_only_not_deployed_benefit' + || outcome.completion_gate_evaluated !== true + || !Array.isArray(records) || records.length !== outcome.value + || typeof outcome.observed_at !== 'string' + || !/^(?:20\d\d)-\d\d-\d\dT/.test(outcome.observed_at) + || !/^[a-f0-9]{64}$/.test(outcome.owner_source_sha256 || '') + || !/^[a-f0-9]{64}$/.test(outcome.portfolio_cohort_sha256 || '')) { + throw new Error('Invalid source-verified Upstream outcome contract'); + } + const seenIds = new Set(); + const seenPrs = new Set(); + const links = records.map((record) => { + if (!record || typeof record.intervention_id !== 'string' || !record.intervention_id + || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9]\d*$/.test(record.external_pr_url || '') + || !/^https:\/\/github\.com\/opensiro\/upstream\/(?:actions\/runs\/[1-9]\d*|blob\/[a-f0-9]{40}\/[^?#]+)$/.test(record.native_receipt || '') + || !/^[a-f0-9]{40}$/.test(record.merge_commit_sha || '') + || record.decision !== 'ACCEPTED_MERGED_CHANGE_ONLY' + || record.acceptance_basis !== 'DETERMINISTIC_VERIFIED_MERGE' + || record.benefit_claim !== 'NOT_MEASURED' + || seenIds.has(record.intervention_id) + || seenPrs.has(record.external_pr_url.toLowerCase())) { + throw new Error('Invalid or duplicated Upstream merged-change evidence'); + } + seenIds.add(record.intervention_id); + seenPrs.add(record.external_pr_url.toLowerCase()); + const short = record.external_pr_url.replace('https://github.com/', ''); + return '
  • ' + + escapeHtml(short) + ' · native CI receipt
    • '; + }).join('\n'); + return '
    ' + + escapeHtml(String(outcome.value)) + + ' source-verified merged changes · inspect evidence' + + '

    Accepted contributor merges only, not deployment or measured user benefit. ' + + 'Observed ' + escapeHtml(outcome.observed_at) + '.

    ' + + '
    '; +} + const windows = ['24h', '7d', '30d']; const rows = snapshot.scope.map((repo) => { const entry = snapshot.repositories[repo]; @@ -104,11 +148,12 @@ const activityRows = snapshot.scope.map((repo) => { }).join('\n'); const collected = typeof snapshot.collected_at === 'string' ? snapshot.collected_at.slice(0, 10) : '—'; +const outcomeEvidence = verifiedUpstreamEvidence(snapshot); const section = `${START}

    Public VSM OSS activity

    Repository-owned state and net canonical change. Updated ${escapeHtml(collected)}.

    - Metrics contract ↗ + Metrics contract ↗
    @@ -119,6 +164,7 @@ ${rows}

    Window values are net canonical-state change, not gross event counts. Unlike outputs are never summed into a productivity score.

    + ${outcomeEvidence}
    Engineering activity non-KPI
    From dab834153ea45946c5658ee5f44bf7dbe01b57f5 Mon Sep 17 00:00:00 2001 From: alexruidan <41616537+xLagerFeuer@users.noreply.github.com> Date: Thu, 12 Nov 2026 01:35:40 +0300 Subject: [PATCH 2/5] site: use live owner-verified Upstream export in existing Index sync and CI --- .github/workflows/check-vsm-oss-metrics.yml | 39 ++++++++++++++++----- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/.github/workflows/check-vsm-oss-metrics.yml b/.github/workflows/check-vsm-oss-metrics.yml index 4f40f9e..8693aa3 100644 --- a/.github/workflows/check-vsm-oss-metrics.yml +++ b/.github/workflows/check-vsm-oss-metrics.yml @@ -102,16 +102,37 @@ jobs: - name: Materialize canonical Index corpus metrics locally run: node scripts/sync-vsm-metrics.cjs --source .upstream/vsm-harness-index + - name: Revalidate Upstream accepted merged changes via first-party GitHub API + shell: bash + env: + GITHUB_TOKEN: ${{ github.token }} + run: | + set -u + if python .upstream/upstream/scripts/verified_external_outcomes.py --report --output-json .upstream/upstream-observed.json && + python .upstream/upstream/scripts/accepted_external_outcomes.py --observation-json .upstream/upstream-observed.json --output-json .upstream/upstream-accepted.json >/dev/null; then + echo "Source-owned first-party Upstream evidence validated." + else + rm -f .upstream/upstream-observed.json .upstream/upstream-accepted.json + echo "::warning::Live external evidence unavailable; outcome metric stays unclaimed." + fi + - name: Collect canonical public VSM OSS snapshot - run: >- - python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py - --profile-root .upstream/vsm-harness-profile - --skills-root .upstream/vsm-harness-skills - --index-root .upstream/vsm-harness-index - --awesome-root .upstream/awesome-vsm-harness - --upstream-root .upstream/upstream - --organization-root .upstream/vsm-oss-organization - --output .upstream/vsm-oss-metrics.json + shell: bash + run: | + set -euo pipefail + accepted=() + if [ -f .upstream/upstream-accepted.json ]; then + accepted+=(--upstream-accepted .upstream/upstream-accepted.json) + fi + python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py \ + --profile-root .upstream/vsm-harness-profile \ + --skills-root .upstream/vsm-harness-skills \ + --index-root .upstream/vsm-harness-index \ + --awesome-root .upstream/awesome-vsm-harness \ + --upstream-root .upstream/upstream \ + --organization-root .upstream/vsm-oss-organization \ + --output .upstream/vsm-oss-metrics.json \ + "${accepted[@]}" - name: Finalize canonical historical windows run: >- From d69f3cc2b11d531a1fdf0908e39daa3ba7014a07 Mon Sep 17 00:00:00 2001 From: alexruidan <41616537+xLagerFeuer@users.noreply.github.com> Date: Thu, 12 Nov 2026 01:35:43 +0300 Subject: [PATCH 3/5] site: use live owner-verified Upstream export in existing Index sync and CI --- .github/workflows/sync-vsm-index.yml | 40 +++++++++++++++++++++------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/.github/workflows/sync-vsm-index.yml b/.github/workflows/sync-vsm-index.yml index a9da558..0c9883c 100644 --- a/.github/workflows/sync-vsm-index.yml +++ b/.github/workflows/sync-vsm-index.yml @@ -154,17 +154,39 @@ jobs: if: steps.preflight.outputs.skip != 'true' run: node scripts/sync-vsm-metrics.cjs --source .upstream/vsm-harness-index + - name: Revalidate Upstream accepted merged changes via first-party GitHub API + if: steps.preflight.outputs.skip != 'true' + shell: bash + env: + GITHUB_TOKEN: ${{ github.token }} + run: | + set -u + if python .upstream/upstream/scripts/verified_external_outcomes.py --report --output-json .upstream/upstream-observed.json && + python .upstream/upstream/scripts/accepted_external_outcomes.py --observation-json .upstream/upstream-observed.json --output-json .upstream/upstream-accepted.json >/dev/null; then + echo "Source-owned first-party Upstream evidence validated." + else + rm -f .upstream/upstream-observed.json .upstream/upstream-accepted.json + echo "::warning::Live external evidence unavailable; outcome metric stays unclaimed." + fi + - name: Collect canonical public VSM OSS snapshot if: steps.preflight.outputs.skip != 'true' - run: >- - python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py - --profile-root .upstream/vsm-harness-profile - --skills-root .upstream/vsm-harness-skills - --index-root .upstream/vsm-harness-index - --awesome-root .upstream/awesome-vsm-harness - --upstream-root .upstream/upstream - --organization-root .upstream/vsm-oss-organization - --output .upstream/vsm-oss-metrics.json + shell: bash + run: | + set -euo pipefail + accepted=() + if [ -f .upstream/upstream-accepted.json ]; then + accepted+=(--upstream-accepted .upstream/upstream-accepted.json) + fi + python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py \ + --profile-root .upstream/vsm-harness-profile \ + --skills-root .upstream/vsm-harness-skills \ + --index-root .upstream/vsm-harness-index \ + --awesome-root .upstream/awesome-vsm-harness \ + --upstream-root .upstream/upstream \ + --organization-root .upstream/vsm-oss-organization \ + --output .upstream/vsm-oss-metrics.json \ + "${accepted[@]}" - name: Finalize VSM OSS historical windows if: steps.preflight.outputs.skip != 'true' From 481defaf50e9130c77c9668e7c5799735b79f684 Mon Sep 17 00:00:00 2001 From: alexruidan <41616537+xLagerFeuer@users.noreply.github.com> Date: Thu, 12 Nov 2026 01:36:30 +0300 Subject: [PATCH 4/5] test: verify exact external outcome links and reject false or mutable evidence --- tests/vsm-oss-metrics-sync.test.cjs | 86 ++++++++++++++++++++++++++++- 1 file changed, 84 insertions(+), 2 deletions(-) diff --git a/tests/vsm-oss-metrics-sync.test.cjs b/tests/vsm-oss-metrics-sync.test.cjs index 6d0955e..af1844f 100644 --- a/tests/vsm-oss-metrics-sync.test.cjs +++ b/tests/vsm-oss-metrics-sync.test.cjs @@ -41,8 +41,35 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating 'opensiro/vsm-harness-skills', 'opensiro/vsm-harness-index', 'opensiro/awesome-vsm-harness', - 'opensiro/vsm-oss-organization' + 'opensiro/vsm-oss-organization', + 'opensiro/upstream' ]; + const upstream = repo('verified_external_outcomes', 2, { + '24h': { status: 'source_unavailable_at_baseline', value: null }, + '7d': { status: 'source_unavailable_at_baseline', value: null }, + '30d': { status: 'source_unavailable_at_baseline', value: null } + }); + Object.assign(upstream.metrics.verified_external_outcomes, { + claim_status: 'verified_merged_changes_only_not_deployed_benefit', + completion_gate_evaluated: true, + observed_at: '2026-11-11T22:10:01+00:00', + owner_source_sha256: 'a'.repeat(64), + portfolio_cohort_sha256: 'b'.repeat(64), + accepted: [ + { intervention_id: 'improvement:agent-fleet', + external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43', + merge_commit_sha: 'c'.repeat(40), + native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700', + acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE', + decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' }, + { intervention_id: 'improvement:citadel', + external_pr_url: 'https://github.com/SethGammon/Citadel/pull/366', + merge_commit_sha: 'd'.repeat(40), + native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40039135313', + acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE', + decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' } + ] + }); put(source, JSON.stringify({ schema_version: 2, collected_at: '2026-09-22T19:00:00Z', @@ -68,7 +95,8 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating '24h': { status: 'unclaimed_semantic_evidence', value: null }, '7d': { status: 'unclaimed_semantic_evidence', value: null }, '30d': { status: 'unclaimed_semantic_evidence', value: null } - }, [65, 295, 295]) + }, [65, 295, 295], + [scope[5]]: upstream } }, null, 2)); @@ -81,6 +109,11 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating assert.match(page, /vsm-harness-index<\/span>included_assessments<\/small><\/th>193<\/td>\+15<\/td>\+112<\/td>\+193<\/td>/); assert.match(page, /awesome-vsm-harness[\s\S]*?0<\/td>−6<\/td>\+5<\/td>/); assert.match(page, /current_formal_construction_milestone[\s\S]*?evidence-gated/); + assert.match(page, /href="https:\/\/github.com\/chankov\/agent-fleet\/pull\/43"/); + assert.match(page, /href="https:\/\/github.com\/SethGammon\/Citadel\/pull\/366"/); + assert.match(page, /2 source-verified merged changes/); + assert.match(page, /not deployment or measured user benefit/); + assert.match(page, /blob\/main\/docs\/METRICS.md/); assert.match(page, /Engineering activity non-KPI<\/span>/); assert.match(page, /commits \/ 24h/); assert.match(page, /Commit volume is audit\/activity telemetry only/); @@ -106,3 +139,52 @@ test('renderer rejects snapshots that promote engineering activity to KPI', () = fs.rmSync(dir, { recursive: true, force: true }); } }); + +test('rendered merged-change evidence rejects benefit inflation or mutable receipts', () => { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'opensiro-upstream-evidence-')); + const script = path.join(dir, 'scripts', 'sync-vsm-oss-metrics.cjs'); + const source = path.join(dir, 'snapshot.json'); + put(script, fs.readFileSync(path.join(root, 'scripts', 'sync-vsm-oss-metrics.cjs'), 'utf8')); + put(path.join(dir, 'vsm-index.html'), ''); + const row = repo('verified_external_outcomes', 1, { + '24h': { status: 'source_unavailable_at_baseline', value: null }, + '7d': { status: 'source_unavailable_at_baseline', value: null }, + '30d': { status: 'source_unavailable_at_baseline', value: null } + }); + const claim = row.metrics.verified_external_outcomes; + Object.assign(claim, { + claim_status: 'verified_merged_changes_only_not_deployed_benefit', + completion_gate_evaluated: true, observed_at: '2026-11-11T22:10:01+00:00', + owner_source_sha256: 'a'.repeat(64), portfolio_cohort_sha256: 'b'.repeat(64), + accepted: [{ intervention_id: 'case:a', + external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43', + merge_commit_sha: 'c'.repeat(40), + native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700', + decision: 'ACCEPTED_MERGED_CHANGE_ONLY', + acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE', benefit_claim: 'NOT_MEASURED' }] + }); + const snapshot = { scope: ['opensiro/upstream'], + repositories: { 'opensiro/upstream': row }, + publication: { window_change_semantics: 'net canonical state change, not gross event count', + engineering_activity_is_productivity_kpi: false } }; + const run = () => spawnSync(process.execPath, [script, '--source', source], { cwd: dir, encoding: 'utf8' }); + try { + put(source, JSON.stringify(snapshot)); + assert.equal(run().status, 0); + claim.accepted[0].benefit_claim = 'DEPLOYED'; + put(source, JSON.stringify(snapshot)); + assert.notEqual(run().status, 0); + assert.match(run().stderr, /Invalid or duplicated Upstream merged-change evidence/); + claim.accepted[0].benefit_claim = 'NOT_MEASURED'; + claim.accepted[0].native_receipt = 'https://github.com/opensiro/upstream/blob/main/test'; + put(source, JSON.stringify(snapshot)); + assert.notEqual(run().status, 0); + claim.value = null; claim.accepted = []; + put(source, JSON.stringify(snapshot)); + assert.equal(run().status, 0); + assert.doesNotMatch(fs.readFileSync(path.join(dir, 'vsm-index.html'), 'utf8'), + /source-verified merged changes/); + } finally { + fs.rmSync(dir, { recursive: true, force: true }); + } +}); From 1930497a6e83c86f68ccbf684f3fd99b15464295 Mon Sep 17 00:00:00 2001 From: alexruidan <41616537+xLagerFeuer@users.noreply.github.com> Date: Thu, 12 Nov 2026 01:36:55 +0300 Subject: [PATCH 5/5] test: close Organization fixture row before Upstream evidence entry --- tests/vsm-oss-metrics-sync.test.cjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/vsm-oss-metrics-sync.test.cjs b/tests/vsm-oss-metrics-sync.test.cjs index af1844f..43c2454 100644 --- a/tests/vsm-oss-metrics-sync.test.cjs +++ b/tests/vsm-oss-metrics-sync.test.cjs @@ -95,7 +95,7 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating '24h': { status: 'unclaimed_semantic_evidence', value: null }, '7d': { status: 'unclaimed_semantic_evidence', value: null }, '30d': { status: 'unclaimed_semantic_evidence', value: null } - }, [65, 295, 295], + }, [65, 295, 295]), [scope[5]]: upstream } }, null, 2));