Publish portable PortfolioTruth consumer contract (#210)

* feat(contract): publish portable PCC fixture

* fix: align contract fixture envelopes

* fix(contract): validate portable producer envelope

* fix(demo): refresh canonical truth fixtures

* fix(contract): fully validate fixture snapshots

* fix(contract): verify serialized fixture fidelity

* fix(demo): align canonical security risk count

* fix(demo): make stale receipt age canonical

* fix(contract): preserve stale provider envelopes

* fix(contract): validate provider and category semantics

* fix(contract): validate normalized evidence envelopes

* fix(contract): validate repository state fidelity

* fix(contract): honor evidence boundaries

* fix(contract): close residual validation gaps

* fix(contract): share producer coverage envelope

* fix(contract): bind portfolio metadata decisions

* fix(contract): remove obsolete attention alias

* Pin portable evidence reason domains

* Enforce producer evidence reachability

* fix: bind portable fixtures to production contracts

* fix: preserve exact upstream branch identity

* fix: bind upstream displays to configured remotes

* fix: stabilize portfolio publication clocks

* fix: bind live normalized security evidence

* fix: order final publication revalidation

* fix: normalize unborn worktree heads

Author: saagpatel

.github/workflows/ci.yml

@@ -25,6 +25,8 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev,serve,semantic]"
+      - name: Verify portable PortfolioTruth consumer contract
+        run: python scripts/generate_portfolio_truth_contract_fixture.py --check
       - name: Run tests
         run: python -m pytest tests/ -v --tb=short
       - name: Lint with ruff

README.md

@@ -113,6 +113,7 @@ Treat campaign/writeback, GitHub Projects, Notion sync, catalog overrides, score
 - Public-safe recording plan: [DEMO-PLAN.md](DEMO-PLAN.md)
 - Product brief: [docs/product/operator-os-product-brief.md](docs/product/operator-os-product-brief.md)
 - Public fixture proof package: [docs/demo-proof/public-fixture/README.md](docs/demo-proof/public-fixture/README.md)
+- Portable PCC contract: [fixtures/contracts/portfolio-command-center-v1/manifest.json](fixtures/contracts/portfolio-command-center-v1/manifest.json)
 - proof-pr dogfood: [docs/proof-pr-dogfood.md](docs/proof-pr-dogfood.md)
 - Product modes: [docs/modes.md](docs/modes.md)
 - Web UI operator guide: [docs/audit-serve.md](docs/audit-serve.md)
@@ -226,6 +227,19 @@ audit serve --output-dir output/demo
 To record the Portfolio Command Center wedge from the same fixture, follow
 [DEMO-PLAN.md](DEMO-PLAN.md) and point the desktop app at `output/demo/`.
 
+The smaller PCC compatibility fixture is fixed-clock and deterministic. GHRA
+owns its manifest, schema identity, generator, and digest; PCC pins the exact
+producer commit separately so the artifact never needs a self-referential Git
+hash. Because the synthetic fixture is not emitted by an attested producer
+checkout, its canonical `producer` evidence is intentionally empty; partial or
+invented producer evidence fails the same validation gate used for publication.
+Regenerate or verify it with:
+
+```bash
+python scripts/generate_portfolio_truth_contract_fixture.py
+python scripts/generate_portfolio_truth_contract_fixture.py --check
+```
+
 ### Quick start (subcommand form)
 
 ```bash

fixtures/contracts/portfolio-command-center-v1/manifest.json

@@ -0,0 +1,32 @@
+{
+  "consumer": {
+    "compatibility_policy": "additive-0.x",
+    "repository": "saagpatel/PortfolioCommandCenter"
+  },
+  "contract_version": "ghra-pcc-portfolio-truth.v1",
+  "fixture": {
+    "additive_canary_paths": [
+      "contract_fixture",
+      "projects[0].additive_contract_canary"
+    ],
+    "coverage_states": [
+      "complete",
+      "partial",
+      "stale",
+      "unknown"
+    ],
+    "evaluation_time": "2026-08-01T06:00:00+00:00",
+    "generated_at": "2026-08-01T00:00:00+00:00",
+    "producer_evidence": "absent",
+    "project_count": 4,
+    "security_evidence_semantics": "synthetic-cross-receipt-state-matrix"
+  },
+  "portfolio_truth_schema_version": "0.11.0",
+  "producer": {
+    "artifact_path": "fixtures/contracts/portfolio-command-center-v1/portfolio-truth.json",
+    "artifact_sha256": "ba3000833f1cd9c89442948ebe51f7e405e7832333a69c6f7347fb2fbfae254a",
+    "generator": "src.portfolio_truth_contract_fixture:build_contract_fixture",
+    "manifest_path": "fixtures/contracts/portfolio-command-center-v1/manifest.json",
+    "repository": "saagpatel/GithubRepoAuditor"
+  }
+}