Publish portable PortfolioTruth consumer contract

.github/workflows/ci.yml

@@ -25,6 +25,8 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev,serve,semantic]"
+      - name: Verify portable PortfolioTruth consumer contract
+        run: python scripts/generate_portfolio_truth_contract_fixture.py --check
       - name: Run tests
         run: python -m pytest tests/ -v --tb=short
       - name: Lint with ruff

README.md

@@ -113,6 +113,7 @@ Treat campaign/writeback, GitHub Projects, Notion sync, catalog overrides, score
 - Public-safe recording plan: [DEMO-PLAN.md](DEMO-PLAN.md)
 - Product brief: [docs/product/operator-os-product-brief.md](docs/product/operator-os-product-brief.md)
 - Public fixture proof package: [docs/demo-proof/public-fixture/README.md](docs/demo-proof/public-fixture/README.md)
+- Portable PCC contract: [fixtures/contracts/portfolio-command-center-v1/manifest.json](fixtures/contracts/portfolio-command-center-v1/manifest.json)
 - proof-pr dogfood: [docs/proof-pr-dogfood.md](docs/proof-pr-dogfood.md)
 - Product modes: [docs/modes.md](docs/modes.md)
 - Web UI operator guide: [docs/audit-serve.md](docs/audit-serve.md)
@@ -226,6 +227,19 @@ audit serve --output-dir output/demo
 To record the Portfolio Command Center wedge from the same fixture, follow
 [DEMO-PLAN.md](DEMO-PLAN.md) and point the desktop app at `output/demo/`.
 
+The smaller PCC compatibility fixture is fixed-clock and deterministic. GHRA
+owns its manifest, schema identity, generator, and digest; PCC pins the exact
+producer commit separately so the artifact never needs a self-referential Git
+hash. Because the synthetic fixture is not emitted by an attested producer
+checkout, its canonical `producer` evidence is intentionally empty; partial or
+invented producer evidence fails the same validation gate used for publication.
+Regenerate or verify it with:
+
+```bash
+python scripts/generate_portfolio_truth_contract_fixture.py
+python scripts/generate_portfolio_truth_contract_fixture.py --check
+```
+
 ### Quick start (subcommand form)
 
 ```bash

fixtures/contracts/portfolio-command-center-v1/manifest.json

@@ -0,0 +1,32 @@
+{
+  "consumer": {
+    "compatibility_policy": "additive-0.x",
+    "repository": "saagpatel/PortfolioCommandCenter"
+  },
+  "contract_version": "ghra-pcc-portfolio-truth.v1",
+  "fixture": {
+    "additive_canary_paths": [
+      "contract_fixture",
+      "projects[0].additive_contract_canary"
+    ],
+    "coverage_states": [
+      "complete",
+      "partial",
+      "stale",
+      "unknown"
+    ],
+    "evaluation_time": "2026-08-01T06:00:00+00:00",
+    "generated_at": "2026-08-01T00:00:00+00:00",
+    "producer_evidence": "absent",
+    "project_count": 4,
+    "security_evidence_semantics": "synthetic-cross-receipt-state-matrix"
+  },
+  "portfolio_truth_schema_version": "0.11.0",
+  "producer": {
+    "artifact_path": "fixtures/contracts/portfolio-command-center-v1/portfolio-truth.json",
+    "artifact_sha256": "ba3000833f1cd9c89442948ebe51f7e405e7832333a69c6f7347fb2fbfae254a",
+    "generator": "src.portfolio_truth_contract_fixture:build_contract_fixture",
+    "manifest_path": "fixtures/contracts/portfolio-command-center-v1/manifest.json",
+    "repository": "saagpatel/GithubRepoAuditor"
+  }
+}