Build capital readiness transaction control plane

.github/workflows/capital-readiness-verification.yml

@@ -0,0 +1,112 @@
+name: Capital Readiness Verification
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "prisma/**"
+      - "scripts/apply-capital-readiness-prisma-models.mjs"
+      - "src/lib/capital-readiness/**"
+      - "src/app/api/capital-readiness/**"
+      - "src/app/app/command-center/capital-readiness/**"
+      - "src/components/command-center/CapitalReadinessCommandCenter.tsx"
+      - ".github/workflows/capital-readiness-verification.yml"
+      - "package.json"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: capital-readiness-verification-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    env:
+      NODE_ENV: test
+      JWT_SECRET: ci-test-secret-min-32-characters-long-placeholder
+      POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
+      POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
+      NEXT_PUBLIC_APP_URL: https://www.gemcybersecurityassist.com
+      NEXT_PUBLIC_APP_NAME: GEM Enterprise
+      NEXT_PUBLIC_AI_DISCLOSURE_TEXT: GEM Concierge is an AI assistant. Responses are informational and require human review for sensitive decisions.
+      AUDIT_ENABLED: "true"
+      SMTP_HOST: ""
+      SMTP_PORT: "587"
+      SMTP_USER: ""
+      SMTP_PASS: ""
+      CRON_SECRET: ci-cron-secret
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Capture environment, installation, and verification
+        id: verification
+        continue-on-error: true
+        shell: bash
+        run: |
+          set +e
+          : > capital-readiness-verify.log
+          {
+            echo "## Environment"
+            node --version
+            npm --version
+            echo "## Enable pnpm"
+            npm install --global pnpm@10.28.0
+            pnpm --version
+            echo "## Install dependencies"
+            pnpm install --frozen-lockfile
+            echo "## Verify"
+            pnpm run verify
+          } 2>&1 | tee -a capital-readiness-verify.log
+          status=${PIPESTATUS[0]}
+          echo "exit_code=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Ensure diagnostic log exists
+        if: always()
+        shell: bash
+        run: |
+          test -f capital-readiness-verify.log || echo "Verification did not reach the diagnostic shell step." > capital-readiness-verify.log
+
+      - name: Upload verification log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: capital-readiness-verification-log
+          path: capital-readiness-verify.log
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Post verification result to pull request
+        if: always() && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        env:
+          VERIFY_EXIT_CODE: ${{ steps.verification.outputs.exit_code }}
+        with:
+          script: |
+            const fs = require('fs');
+            const exitCode = process.env.VERIFY_EXIT_CODE || 'bootstrap_failure';
+            const log = fs.readFileSync('capital-readiness-verify.log', 'utf8');
+            const tail = log.split('\n').slice(-220).join('\n');
+            const marker = '<!-- capital-readiness-verification -->';
+            const body = `${marker}\n## Capital Readiness Verification\n\n**Exit code:** \`${exitCode}\`\n\n<details><summary>Verification log tail</summary>\n\n\`\`\`text\n${tail.slice(0, 60000)}\n\`\`\`\n</details>`;
+            const { owner, repo } = context.repo;
+            const issue_number = context.issue.number;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
+            const existing = comments.find((comment) => comment.body?.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }
+
+      - name: Enforce verification result
+        if: always() && steps.verification.outputs.exit_code != '0'
+        run: exit 1