chore: add guarded path-aware Vercel deployment orchestration

[atomicdjt]

Purpose

Implements the first approved portfolio-remediation checkpoint: a deterministic, auditable deployment controller designed to replace monorepo-wide Vercel Git fan-out after a controlled preview validation.

Implemented

• records the July 17 baseline, production boundary, and rollback position;
• adds config/vercel-projects.json as the declarative deployment matrix;
• adds deterministic changed-path and explicit-project selection in scripts/detect-affected-apps.mjs;
• adds Node tests for documentation-only, app-only, root dependency, manual legacy, deduplication, explicit project selection, unknown project rejection, and invalid-manifest behavior;
• adds the selector to Portfolio CI and the root release verification path;
• adds Vercel Affected Deployment Plan for changed-file detection, plan artifacts, summaries, guarded deployment, and HTTP smoke checking;
• pins the guarded deployment design to Vercel CLI 54.21.1;
• allows a manual dispatch to target exactly one active project;
• keeps pull requests plan-only so credentialed Vercel execution never runs against pull-request code;
• requires both the repository activation variable and an explicit manual execution choice for a credentialed manual preview;
• documents the activation, validation, cutover, and rollback checkpoint.

Test-first evidence

Two red-green cycles were recorded:

1. The first Portfolio CI run failed at Test deployment selector because the selector module did not exist. Documentation and policy checks passed before that expected failure. The minimal affected-path implementation then made the test pass.
2. A later test required explicit single-project selection and failed because selectRequestedProjects did not exist. The explicit-selector implementation then made the expanded suite pass.

Current dry-run behavior

• Pull requests generate an affected-project plan and artifact only.
• The deploy job is explicitly disabled for the pull_request event.
• A manual dispatch defaults to project_id: auto and execute_deployment: false.
• A manual preview can be constrained to layerforge-studio only.
• Preserved Amino Acid Workbench and HearthLink artifacts remain manual-only.
• The deployment matrix remains skipped because VERCEL_DEPLOYMENT_ORCHESTRATION_ENABLED has not been set to true.

Production boundary

This PR does not currently:

• disable an existing Vercel Git integration;
• set the deployment activation variable;
• create, expose, or consume a Vercel token;
• change a canonical production alias;
• remove application source;
• create the standalone ProcessHarbor repository.

Fresh verification on head 5edcd505358d2df236b5f3f3f2684085cc11058e

• Portfolio CI: success
  • documentation check
  • Vercel-only policy
  • deployment-selector tests
  • all configured lint checks
  • all configured type checks
  • all configured application tests
  • all configured application production builds
• Portfolio Vercel Readiness: success
• ProcessHarbor Pro Verify: success, including Playwright E2E
• Vercel Affected Deployment Plan: success; deploy matrix skipped as designed

Checkpoint before cutover

The draft is ready for checkpoint review. The next controlled sequence is:

1. merge this guarded architecture while native Vercel Git deployment remains unchanged;
2. create and store VERCEL_TOKEN as a GitHub Actions repository secret;
3. activate orchestration temporarily;
4. manually dispatch a LayerForge-only preview;
5. review link/build/deploy/smoke evidence;
6. only then prepare the separate native-Git cutover that adds git.deploymentEnabled: false.

See docs/remediation/DEPLOYMENT-ORCHESTRATION-CHECKPOINT.md for the complete safeguards and rollback steps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-project-portfolio-focusforge	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-layerforge-studio	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-opspilot-ai-operations-toolkit	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-portfolio-hub	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-redactready-local	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-redactready-pro-hri-os	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-scamshield-ai	Ready	Preview, Comment	Jul 17, 2026 8:26pm
ai-project-portfolio-variantvision-pro	Ready	Preview, Comment	Jul 17, 2026 8:26pm

[atomicdjt]

Checkpoint 1 verified

The guarded deployment architecture is ready for review.

Passing evidence

• Portfolio CI: success
  • documentation links
  • Vercel-only policy
  • deployment-selector tests
  • lint
  • type checking
  • application tests
  • all configured application builds
• Portfolio Vercel Readiness: success
• ProcessHarbor Pro Verify: success, including Playwright
• Vercel Affected Deployment Plan: success
  • plan artifact generated
  • active projects selected conservatively because global build inputs changed
  • deploy matrix skipped because activation is disabled

Production boundary remains intact

• No git.deploymentEnabled setting has been changed.
• No Vercel token or repository activation variable has been set.
• No canonical alias has been changed.
• No source has been removed.
• This PR remains a draft and is not merged.

Next controlled action

Add the VERCEL_TOKEN GitHub Actions secret, enable orchestration only for a controlled LayerForge preview, verify project linking/build/deployment/smoke checking, and then return to review before disabling native Vercel Git deployment across the monorepo projects.

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/atomicdjts-projects?upgradeToPro=build-rate-limit

[atomicdjt]

Checkpoint 1 — final verified state

Fresh verification on head 5edcd505358d2df236b5f3f3f2684085cc11058e:

• Portfolio CI: success
  • documentation
  • deployment policy
  • selector regression tests
  • lint
  • type checking
  • application tests
  • all configured production builds
• Portfolio Vercel Readiness: success
• ProcessHarbor Pro Verify: success, including Playwright E2E
• Vercel Affected Deployment Plan: success; credentialed deployment job skipped

Security review additions:

• pull requests are plan-only and cannot execute the token-bearing deployment job;
• manual dispatch can select exactly one active project;
• manual dispatch defaults to plan-only;
• deployment requires the repository activation variable plus explicit execution approval;
• legacy artifacts remain excluded from automatic deployment;
• unused per-project secret metadata was removed.

No native Vercel Git integration, alias, source authority, or production configuration has been changed. The PR remains a draft and unmerged pending checkpoint approval.