ci: enforce committed snapshot and dashboard evidence health (#521)

.github/workflows/contract.yml

@@ -43,3 +43,9 @@ jobs:
 
       - name: Run error drift script tests
         run: node --test scripts/check-round-errors.test.mjs
+
+      - name: Check committed snapshot health
+        run: node scripts/check-snapshots.mjs
+
+      - name: Run snapshot health script tests
+        run: node --test scripts/check-snapshots.test.mjs

.github/workflows/snapshots.yml

@@ -0,0 +1,40 @@
+name: Snapshot health check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  snapshots:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.13.1
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: pnpm
+
+      - name: Install JS dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Run snapshot health unit tests
+        run: pnpm snapshot:test
+
+      - name: Check committed contract snapshots and dashboard evidence
+        run: pnpm snapshot:check

README.md

@@ -167,6 +167,7 @@ pnpm install
 pnpm contract:test          # 14 Rust tests
 pnpm bindings:generate      # generate TS bindings from the contract
 pnpm bindings:check         # verify committed bindings match the contract
+pnpm snapshot:check         # verify committed contract snapshots & dashboard evidence
 pnpm web:dev                # jury UI — works without .env
 pnpm agents:e2e             # testnet full agent proof (needs stellar keys)
 pnpm mainnet:verify         # mainnet read-only proof

docs/CI.md

@@ -166,3 +166,12 @@ policy locally:
 pnpm rust:audit:test
 pnpm rust:audit:check
 ```
+
+## Snapshot health check
+
+GitHub Actions workflow: `.github/workflows/snapshots.yml` (and `.github/workflows/contract.yml`)
+
+Runs `pnpm snapshot:test` (`node --test scripts/check-snapshots.test.mjs`) and `pnpm snapshot:check` (`node scripts/check-snapshots.mjs`) on pushes to `main` and on pull requests. The check fails when:
+
+1. Any required contract test snapshot category under `contracts/round/test_snapshots/test` is missing, or any committed `.json` snapshot fails Soroban payload validation (`generators`, `auth`, `ledger`, `events`).
+2. Committed dashboard demo evidence (`apps/web/src/demo/demo-trace.generated.ts` and `apps/web/src/demo/demo-trace.checksum.ts`) is missing, has a stale `LIFE_CYCLE_PHASES_CHECKSUM`, omits required lifecycle milestones or bidder/auditor evidence blobs, or contains a secret seed.

package.json

@@ -81,6 +81,7 @@
     "web:test": "pnpm --filter @sub-rosa/web test",
     "web:typecheck": "pnpm --filter @sub-rosa/web typecheck",
     "snapshot:check": "node scripts/check-snapshots.mjs",
+    "snapshot:test": "node --test scripts/check-snapshots.test.mjs",
     "docs:check": "node scripts/check-deploy-docs.mjs",
     "docs:check-links": "node scripts/check-links.js",
     "coverage:test": "node --test scripts/check-rust-audit.test.mjs && node scripts/check-rust-audit.mjs && node --test scripts/run-ts-coverage.test.mjs && node scripts/run-ts-coverage.mjs",