From 0f38063facbd26ec55ca3a37d1789e4584c6251a Mon Sep 17 00:00:00 2001
From: sovereign <sovereign@op-core-vm.story-ule.ts.net>
Date: Thu, 18 Dec 2025 00:19:19 +0000
Subject: [PATCH] ci: add GitLab freeze assertion

---
 .github/workflows/freeze-envelope.yml | 15 ---------------
 .gitlab-ci.yml                        | 20 ++++++++++++++++++++
 COOLING_CHECKLIST.md                  |  5 +++--
 3 files changed, 23 insertions(+), 17 deletions(-)
 delete mode 100644 .github/workflows/freeze-envelope.yml
 create mode 100644 .gitlab-ci.yml

diff --git a/.github/workflows/freeze-envelope.yml b/.github/workflows/freeze-envelope.yml
deleted file mode 100644
index fea1da7..0000000
--- a/.github/workflows/freeze-envelope.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Freeze Envelope Byte Contract
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  freeze-envelope:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Assert EventEnvelope byte contract
-        run: cargo test -p vaultmesh-command-center test_event_envelope_canonicalization_bytes
-
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..821c6ca
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,20 @@
+stages:
+  - test
+
+freeze:envelope-byte-contract:
+  stage: test
+  image: rust:stable
+  variables:
+    CARGO_TERM_COLOR: always
+  cache:
+    key: cargo
+    paths:
+      - target/
+      - .cargo/registry/
+      - .cargo/git/
+  before_script:
+    - rustc --version
+    - cargo --version
+  script:
+    - cargo test -p vaultmesh-command-center test_event_envelope_canonicalization_bytes
+
diff --git a/COOLING_CHECKLIST.md b/COOLING_CHECKLIST.md
index b0e08ad..77adb89 100644
--- a/COOLING_CHECKLIST.md
+++ b/COOLING_CHECKLIST.md
@@ -5,5 +5,6 @@ For the next 30 days, treat these as frozen invariants: do not change `EventEnve
 No envelope changes without: a payload schema bump, a full replay audit rerun, and a new freeze tag.
 
 Freeze tag: `v0.8-freeze-envelope-v0` currently exists locally; when ready to publish, push it (and the commit) with:
-- `git push origin 1830e0f:main`
-- `git push origin v0.8-freeze-envelope-v0`
+- `git remote add gitlab <gitlab-repo-url>` (one-time)
+- `git push gitlab main`
+- `git push gitlab v0.8-freeze-envelope-v0`