feat: add deterministic ProofPath Control Cloud demo

[safal207]

What changed

Adds the first product-shaped ProofPath Control Cloud v0.1 layer on top of the GitHub Evidence Collector from #209.

Assured Action certificates
+ risk tiers
+ operator assignments
+ settlement policy
        ↓
Control Cloud snapshot builder
        ↓
deterministic snapshot + JSONL audit export
        ↓
static decision/economics/operator dashboard

The implementation adds:

• a dependency-free deterministic snapshot builder;
• strict dataset and snapshot schemas;
• ACCEPT / HOLD / BLOCK / CHALLENGE KPI aggregation;
• integer minor-unit and basis-point settlement preview math;
• deterministic operator-pool distribution with exact remainder handling;
• gross/platform/operator/infrastructure/reserve conservation invariants;
• duplicate action and clearance-root rejection;
• a domain-separated snapshot root;
• one canonical audit event per Assured Action;
• a dependency-free browser dashboard;
• exact snapshot and audit-export keyless build attestations;
• 15 focused invariant/mutation tests and 10 static security tests.

Financial boundary

This is a settlement simulation, not a payment service.

financial_mode: SIMULATION_ONLY
financial_status: SIMULATION_ONLY_NOT_PAYABLE
payments_executed: false
insurance_provided: false

The implementation calls no bank, payment processor, wallet, exchange, or blockchain. Operator earnings are previews, not balances, debts, invoices, payout instructions, insurance reserves, or guarantees.

Assurance boundary

Control Cloud summarizes supplied certificates. It does not re-run Deploy Guard, verify certificate provenance independently, deploy software, grant authority, or claim an external quorum.

deployment_performed: false
authority_granted: false
external_quorum_claimed: false

Reference economics

The fixture has one action in each decision class and one action in each risk tier.

actions:                 4
gross preview:           25500 USD minor units
operator pool:           14024
platform preview:         7652
dispute reserve preview:  2550
infrastructure preview:   1274
snapshot root: sha256:a782f7a1b8fc5d7a6a11815066191a304a32231d969381637902a75f55467deb

Every minor unit is conserved, and every operator allocation is deterministic.

Dashboard

The workflow artifact contains:

index.html
control-cloud-snapshot.json
audit-export.jsonl
conformance-manifest.json
README.md

The dashboard has no external scripts, fonts, analytics, payment SDKs, or cloud credentials. It displays decision mix, operator earnings preview, Assured Action ledger, financial summary, and snapshot root.

CI and attestations

The workflow:

1. compiles the builder and validates JSON inputs;
2. runs focused invariant and security tests;
3. builds the exact reference snapshot and JSONL audit export;
4. verifies the expected deterministic root and financial totals;
5. keyless-attests the exact snapshot bytes;
6. keyless-attests the exact audit-export bytes;
7. uploads the complete static product artifact for 14 days.

Permissions are limited to:

contents: read
id-token: write
attestations: write

No merge is performed by this PR.

Stacked PR

Base: agent/proofpath-github-evidence-collector-v0.1 / #209

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7490a4bb-90ef-4969-a34f-15fd50dc3c42

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final source head: aaf0fd0f53616b456eb4984f8d37384cb6688c95

Pull-request workflow subject: 4d8a57a365fc91409e5426e27179ff1017a3a2c5

ProofPath Control Cloud run #2

Run 30718784055 passed on a GitHub-hosted runner.

• 15 invariant/mutation tests passed.
• 10 static security tests passed.
• Deterministic snapshot build passed.
• Canonical four-line JSONL audit export passed.
• Exact snapshot bytes were keyless-attested.
• Exact audit-export bytes were keyless-attested.
• Static dashboard artifact was uploaded.

Reference result:

actions:                  4
ACCEPT / HOLD / BLOCK / CHALLENGE: 1 each
gross preview:            25500 USD minor units
operator pool:            14024
platform preview:          7652
dispute reserve preview:   2550
infrastructure preview:    1274
snapshot root:             sha256:a782f7a1b8fc5d7a6a11815066191a304a32231d969381637902a75f55467deb

Attested subjects:

control-cloud-snapshot.json
sha256:0d7c59263ebe1f707a12bc31957a335f15b55f3ddebb6361a9d3e78bb560fa8d
GitHub attestation: 38357239
Rekor log index: 2314609146

audit-export.jsonl
sha256:a58b148c2eeb6146f16c61c6f0707078aad11f39df6eeeb39598377af84e49cd
GitHub attestation: 38357240
Rekor log index: 2314609391

Product artifact:

name: proofpath-control-cloud-30718784055
artifact ID: 8824171970
SHA-256: 53868726edec7262b03f65e580e267ba2d0f3e586b0cc398cde8fd9948f8b138
size: 9577 bytes
expires: 2026-08-15T21:16:35Z

Existing stack regressions

All passed on the same final head:

• ProofPath Deploy Guard run Add network and message broker gate demo #36 (30718784064).
• Rust run #323 (30718784056): formatting, clippy, workspace tests, Compute Witness, reusable Action, Personal Agent Guard, and Agent Payment Guard.

Honest boundary

financial_mode: SIMULATION_ONLY
financial_status: SIMULATION_ONLY_NOT_PAYABLE
payments_executed: false
insurance_provided: false
deployment_performed: false
authority_granted: false
external_quorum_claimed: false

No payment processor, bank, wallet, exchange, blockchain, cloud deployment command, IAM mutation, or repository merge was executed.