site: publish Organization-verified Upstream merged changes with evidence links

.github/workflows/check-vsm-oss-metrics.yml

@@ -102,16 +102,37 @@ jobs:
       - name: Materialize canonical Index corpus metrics locally
         run: node scripts/sync-vsm-metrics.cjs --source .upstream/vsm-harness-index
 
+      - name: Revalidate Upstream accepted merged changes via first-party GitHub API
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -u
+          if python .upstream/upstream/scripts/verified_external_outcomes.py --report --output-json .upstream/upstream-observed.json &&
+             python .upstream/upstream/scripts/accepted_external_outcomes.py --observation-json .upstream/upstream-observed.json --output-json .upstream/upstream-accepted.json >/dev/null; then
+            echo "Source-owned first-party Upstream evidence validated."
+          else
+            rm -f .upstream/upstream-observed.json .upstream/upstream-accepted.json
+            echo "::warning::Live external evidence unavailable; outcome metric stays unclaimed."
+          fi
+
       - name: Collect canonical public VSM OSS snapshot
-        run: >-
-          python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py
-          --profile-root .upstream/vsm-harness-profile
-          --skills-root .upstream/vsm-harness-skills
-          --index-root .upstream/vsm-harness-index
-          --awesome-root .upstream/awesome-vsm-harness
-          --upstream-root .upstream/upstream
-          --organization-root .upstream/vsm-oss-organization
-          --output .upstream/vsm-oss-metrics.json
+        shell: bash
+        run: |
+          set -euo pipefail
+          accepted=()
+          if [ -f .upstream/upstream-accepted.json ]; then
+            accepted+=(--upstream-accepted .upstream/upstream-accepted.json)
+          fi
+          python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py \
+            --profile-root .upstream/vsm-harness-profile \
+            --skills-root .upstream/vsm-harness-skills \
+            --index-root .upstream/vsm-harness-index \
+            --awesome-root .upstream/awesome-vsm-harness \
+            --upstream-root .upstream/upstream \
+            --organization-root .upstream/vsm-oss-organization \
+            --output .upstream/vsm-oss-metrics.json \
+            "${accepted[@]}"
 
       - name: Finalize canonical historical windows
         run: >-

.github/workflows/sync-vsm-index.yml

@@ -154,17 +154,39 @@ jobs:
         if: steps.preflight.outputs.skip != 'true'
         run: node scripts/sync-vsm-metrics.cjs --source .upstream/vsm-harness-index
 
+      - name: Revalidate Upstream accepted merged changes via first-party GitHub API
+        if: steps.preflight.outputs.skip != 'true'
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -u
+          if python .upstream/upstream/scripts/verified_external_outcomes.py --report --output-json .upstream/upstream-observed.json &&
+             python .upstream/upstream/scripts/accepted_external_outcomes.py --observation-json .upstream/upstream-observed.json --output-json .upstream/upstream-accepted.json >/dev/null; then
+            echo "Source-owned first-party Upstream evidence validated."
+          else
+            rm -f .upstream/upstream-observed.json .upstream/upstream-accepted.json
+            echo "::warning::Live external evidence unavailable; outcome metric stays unclaimed."
+          fi
+
       - name: Collect canonical public VSM OSS snapshot
         if: steps.preflight.outputs.skip != 'true'
-        run: >-
-          python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py
-          --profile-root .upstream/vsm-harness-profile
-          --skills-root .upstream/vsm-harness-skills
-          --index-root .upstream/vsm-harness-index
-          --awesome-root .upstream/awesome-vsm-harness
-          --upstream-root .upstream/upstream
-          --organization-root .upstream/vsm-oss-organization
-          --output .upstream/vsm-oss-metrics.json
+        shell: bash
+        run: |
+          set -euo pipefail
+          accepted=()
+          if [ -f .upstream/upstream-accepted.json ]; then
+            accepted+=(--upstream-accepted .upstream/upstream-accepted.json)
+          fi
+          python .upstream/vsm-oss-organization/scripts/collect_public_metrics.py \
+            --profile-root .upstream/vsm-harness-profile \
+            --skills-root .upstream/vsm-harness-skills \
+            --index-root .upstream/vsm-harness-index \
+            --awesome-root .upstream/awesome-vsm-harness \
+            --upstream-root .upstream/upstream \
+            --organization-root .upstream/vsm-oss-organization \
+            --output .upstream/vsm-oss-metrics.json \
+            "${accepted[@]}"
 
       - name: Finalize VSM OSS historical windows
         if: steps.preflight.outputs.skip != 'true'

scripts/sync-vsm-oss-metrics.cjs

@@ -79,6 +79,50 @@ if (snapshot.publication.engineering_activity_is_productivity_kpi !== false) {
   throw new Error('Engineering activity must remain non-KPI');
 }
 
+function verifiedUpstreamEvidence(snapshot) {
+  const owner = snapshot.repositories['opensiro/upstream'];
+  const outcome = owner && owner.metrics && owner.metrics.verified_external_outcomes;
+  if (!outcome || outcome.value == null) return '';
+  const records = outcome.accepted;
+  if (!Number.isSafeInteger(outcome.value) || outcome.value < 0
+      || outcome.claim_status !== 'verified_merged_changes_only_not_deployed_benefit'
+      || outcome.completion_gate_evaluated !== true
+      || !Array.isArray(records) || records.length !== outcome.value
+      || typeof outcome.observed_at !== 'string'
+      || !/^(?:20\d\d)-\d\d-\d\dT/.test(outcome.observed_at)
+      || !/^[a-f0-9]{64}$/.test(outcome.owner_source_sha256 || '')
+      || !/^[a-f0-9]{64}$/.test(outcome.portfolio_cohort_sha256 || '')) {
+    throw new Error('Invalid source-verified Upstream outcome contract');
+  }
+  const seenIds = new Set();
+  const seenPrs = new Set();
+  const links = records.map((record) => {
+    if (!record || typeof record.intervention_id !== 'string' || !record.intervention_id
+        || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9]\d*$/.test(record.external_pr_url || '')
+        || !/^https:\/\/github\.com\/opensiro\/upstream\/(?:actions\/runs\/[1-9]\d*|blob\/[a-f0-9]{40}\/[^?#]+)$/.test(record.native_receipt || '')
+        || !/^[a-f0-9]{40}$/.test(record.merge_commit_sha || '')
+        || record.decision !== 'ACCEPTED_MERGED_CHANGE_ONLY'
+        || record.acceptance_basis !== 'DETERMINISTIC_VERIFIED_MERGE'
+        || record.benefit_claim !== 'NOT_MEASURED'
+        || seenIds.has(record.intervention_id)
+        || seenPrs.has(record.external_pr_url.toLowerCase())) {
+      throw new Error('Invalid or duplicated Upstream merged-change evidence');
+    }
+    seenIds.add(record.intervention_id);
+    seenPrs.add(record.external_pr_url.toLowerCase());
+    const short = record.external_pr_url.replace('https://github.com/', '');
+    return '<li><a href="' + escapeHtml(record.external_pr_url) + '">'
+      + escapeHtml(short) + '</a> · <a href="'
+      + escapeHtml(record.native_receipt) + '">native CI receipt</a></li>';
+  }).join('\n');
+  return '<details class="vhi-org-semantics"><summary>'
+    + escapeHtml(String(outcome.value))
+    + ' source-verified merged changes · inspect evidence</summary>'
+    + '<p>Accepted contributor merges only, not deployment or measured user benefit. '
+    + 'Observed ' + escapeHtml(outcome.observed_at) + '.</p>'
+    + '<ul>' + links + '</ul></details>';
+}
+
 const windows = ['24h', '7d', '30d'];
 const rows = snapshot.scope.map((repo) => {
   const entry = snapshot.repositories[repo];
@@ -104,11 +148,12 @@ const activityRows = snapshot.scope.map((repo) => {
 }).join('\n');
 
 const collected = typeof snapshot.collected_at === 'string' ? snapshot.collected_at.slice(0, 10) : '—';
+const outcomeEvidence = verifiedUpstreamEvidence(snapshot);
 const section = `${START}
   <section class="vhi-org-metrics" aria-labelledby="vhi-org-metrics-title">
     <header class="vhi-metrics-head vhi-org-metrics-head">
       <div><h2 id="vhi-org-metrics-title">Public VSM OSS activity</h2><p>Repository-owned state and net canonical change. Updated ${escapeHtml(collected)}.</p></div>
-      <a href="https://github.com/opensiro/vsm-oss-organization/blob/main/METRICS.md" target="_blank" rel="noopener">Metrics contract &#8599;</a>
+      <a href="https://github.com/opensiro/vsm-oss-organization/blob/main/docs/METRICS.md" target="_blank" rel="noopener">Metrics contract &#8599;</a>
     </header>
     <div class="vhi-org-table-wrap" tabindex="0" role="region" aria-label="Public VSM OSS canonical state change">
       <table class="vhi-org-table">
@@ -119,6 +164,7 @@ ${rows}
       </table>
     </div>
     <p class="vhi-org-semantics">Window values are net canonical-state change, not gross event counts. Unlike outputs are never summed into a productivity score.</p>
+    ${outcomeEvidence}
     <details class="vhi-engineering-activity">
       <summary>Engineering activity <span>non-KPI</span></summary>
       <div class="vhi-org-table-wrap">

tests/vsm-oss-metrics-sync.test.cjs

@@ -41,8 +41,35 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
     'opensiro/vsm-harness-skills',
     'opensiro/vsm-harness-index',
     'opensiro/awesome-vsm-harness',
-    'opensiro/vsm-oss-organization'
+    'opensiro/vsm-oss-organization',
+    'opensiro/upstream'
   ];
+  const upstream = repo('verified_external_outcomes', 2, {
+    '24h': { status: 'source_unavailable_at_baseline', value: null },
+    '7d': { status: 'source_unavailable_at_baseline', value: null },
+    '30d': { status: 'source_unavailable_at_baseline', value: null }
+  });
+  Object.assign(upstream.metrics.verified_external_outcomes, {
+    claim_status: 'verified_merged_changes_only_not_deployed_benefit',
+    completion_gate_evaluated: true,
+    observed_at: '2026-11-11T22:10:01+00:00',
+    owner_source_sha256: 'a'.repeat(64),
+    portfolio_cohort_sha256: 'b'.repeat(64),
+    accepted: [
+      { intervention_id: 'improvement:agent-fleet',
+        external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43',
+        merge_commit_sha: 'c'.repeat(40),
+        native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700',
+        acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE',
+        decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' },
+      { intervention_id: 'improvement:citadel',
+        external_pr_url: 'https://github.com/SethGammon/Citadel/pull/366',
+        merge_commit_sha: 'd'.repeat(40),
+        native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40039135313',
+        acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE',
+        decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' }
+    ]
+  });
   put(source, JSON.stringify({
     schema_version: 2,
     collected_at: '2026-09-22T19:00:00Z',
@@ -68,7 +95,8 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
         '24h': { status: 'unclaimed_semantic_evidence', value: null },
         '7d': { status: 'unclaimed_semantic_evidence', value: null },
         '30d': { status: 'unclaimed_semantic_evidence', value: null }
-      }, [65, 295, 295])
+      }, [65, 295, 295]),
+      [scope[5]]: upstream
     }
   }, null, 2));
 
@@ -81,6 +109,11 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
     assert.match(page, /vsm-harness-index<\/span><small>included_assessments<\/small><\/th><td class="is-number">193<\/td><td class="is-positive">\+15<\/td><td class="is-positive">\+112<\/td><td class="is-positive">\+193<\/td>/);
     assert.match(page, /awesome-vsm-harness[\s\S]*?<td class="is-muted">0<\/td><td class="is-negative">−6<\/td><td class="is-positive">\+5<\/td>/);
     assert.match(page, /current_formal_construction_milestone[\s\S]*?evidence-gated/);
+    assert.match(page, /href="https:\/\/github.com\/chankov\/agent-fleet\/pull\/43"/);
+    assert.match(page, /href="https:\/\/github.com\/SethGammon\/Citadel\/pull\/366"/);
+    assert.match(page, /2 source-verified merged changes/);
+    assert.match(page, /not deployment or measured user benefit/);
+    assert.match(page, /blob\/main\/docs\/METRICS.md/);
     assert.match(page, /Engineering activity <span>non-KPI<\/span>/);
     assert.match(page, /commits \/ 24h/);
     assert.match(page, /Commit volume is audit\/activity telemetry only/);
@@ -106,3 +139,52 @@ test('renderer rejects snapshots that promote engineering activity to KPI', () =
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test('rendered merged-change evidence rejects benefit inflation or mutable receipts', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'opensiro-upstream-evidence-'));
+  const script = path.join(dir, 'scripts', 'sync-vsm-oss-metrics.cjs');
+  const source = path.join(dir, 'snapshot.json');
+  put(script, fs.readFileSync(path.join(root, 'scripts', 'sync-vsm-oss-metrics.cjs'), 'utf8'));
+  put(path.join(dir, 'vsm-index.html'), '<html><body><!-- VSM INDEX METRICS:END --></body></html>');
+  const row = repo('verified_external_outcomes', 1, {
+    '24h': { status: 'source_unavailable_at_baseline', value: null },
+    '7d': { status: 'source_unavailable_at_baseline', value: null },
+    '30d': { status: 'source_unavailable_at_baseline', value: null }
+  });
+  const claim = row.metrics.verified_external_outcomes;
+  Object.assign(claim, {
+    claim_status: 'verified_merged_changes_only_not_deployed_benefit',
+    completion_gate_evaluated: true, observed_at: '2026-11-11T22:10:01+00:00',
+    owner_source_sha256: 'a'.repeat(64), portfolio_cohort_sha256: 'b'.repeat(64),
+    accepted: [{ intervention_id: 'case:a',
+      external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43',
+      merge_commit_sha: 'c'.repeat(40),
+      native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700',
+      decision: 'ACCEPTED_MERGED_CHANGE_ONLY',
+      acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE', benefit_claim: 'NOT_MEASURED' }]
+  });
+  const snapshot = { scope: ['opensiro/upstream'],
+    repositories: { 'opensiro/upstream': row },
+    publication: { window_change_semantics: 'net canonical state change, not gross event count',
+      engineering_activity_is_productivity_kpi: false } };
+  const run = () => spawnSync(process.execPath, [script, '--source', source], { cwd: dir, encoding: 'utf8' });
+  try {
+    put(source, JSON.stringify(snapshot));
+    assert.equal(run().status, 0);
+    claim.accepted[0].benefit_claim = 'DEPLOYED';
+    put(source, JSON.stringify(snapshot));
+    assert.notEqual(run().status, 0);
+    assert.match(run().stderr, /Invalid or duplicated Upstream merged-change evidence/);
+    claim.accepted[0].benefit_claim = 'NOT_MEASURED';
+    claim.accepted[0].native_receipt = 'https://github.com/opensiro/upstream/blob/main/test';
+    put(source, JSON.stringify(snapshot));
+    assert.notEqual(run().status, 0);
+    claim.value = null; claim.accepted = [];
+    put(source, JSON.stringify(snapshot));
+    assert.equal(run().status, 0);
+    assert.doesNotMatch(fs.readFileSync(path.join(dir, 'vsm-index.html'), 'utf8'),
+      /source-verified merged changes/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});