ops: verify production rollout preflight

.github/workflows/skills-sh-sync.yml

@@ -13,6 +13,7 @@ on:
         options:
           - sync
           - dark-preflight
+          - rollout-preflight
 
 concurrency:
   group: skills-sh-production-sync
@@ -130,3 +131,85 @@ jobs:
           name: claw-603-production-dark-preflight-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: error
           path: capabilities-*.json
+
+  rollout-preflight:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'rollout-preflight' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: Production
+    env:
+      TARGET_SHA: a5ffae2196c2504561f78baccee7108b3ed18f5e
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ env.TARGET_SHA }}
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Verify exact deployment and arm only skills.sh runtime
+        env:
+          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          live_main="$(gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)"
+          if [[ "$live_main" != "$TARGET_SHA" ]]; then
+            echo "::error::origin/main advanced to $live_main"
+            exit 1
+          fi
+
+          bunx convex run appMeta:getDeploymentInfo --prod > deployment.json
+          jq -e --arg sha "$TARGET_SHA" '
+            .appBuildSha == $sha and
+            (.deployedAt | type == "string" and length > 0)
+          ' deployment.json >/dev/null
+
+          current_mode="$(bunx convex env get CLAWHUB_SKILLS_SH_ROLLOUT_MODE --prod)"
+          if [[ "$current_mode" != "off" ]]; then
+            echo "::error::expected dark skills.sh mode before rollout preflight, got $current_mode"
+            exit 1
+          fi
+
+          bunx convex run rolloutCapabilities:getPublicCapabilities --prod \
+            > capabilities-before.json
+          jq -e '
+            .environment == "production" and
+            .skillsSh.mode == "off" and
+            .skillsSh.runtimeEnabled == false and
+            .skillsSh.publicCatalogEnabled == false and
+            .skillsSh.scanPlanningEnabled == false and
+            .skillsSh.scanAdmissionEnabled == false and
+            .githubSkillSync.selfServiceEnabled == false
+          ' capabilities-before.json >/dev/null
+
+          armed=0
+          cleanup() {
+            exit_code=$?
+            trap - EXIT
+            if [[ "$armed" == "1" ]]; then
+              bunx convex env set CLAWHUB_SKILLS_SH_ROLLOUT_MODE off --prod
+            fi
+            exit "$exit_code"
+          }
+          trap cleanup EXIT
+
+          armed=1
+          bunx convex env set CLAWHUB_SKILLS_SH_ROLLOUT_MODE production --prod
+
+          bunx convex run rolloutCapabilities:getPublicCapabilities --prod \
+            > capabilities-after.json
+          jq -e '
+            .environment == "production" and
+            .skillsSh.mode == "production" and
+            .skillsSh.runtimeEnabled == true and
+            .skillsSh.publicCatalogEnabled == false and
+            .skillsSh.scanPlanningEnabled == false and
+            .skillsSh.scanAdmissionEnabled == false and
+            .githubSkillSync.selfServiceEnabled == false
+          ' capabilities-after.json >/dev/null
+          armed=0
+          trap - EXIT
+          jq -c '{appBuildSha,deployedAt}' deployment.json
+          jq -c '{environment,skillsSh,githubSkillSync}' capabilities-after.json