net-kingdom/docs/evidence/2026-10-11-layer-v07-immutable-publication/README.md
tegwick f4436dadd5
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Preserve exact served security layer v0.7 revision artifacts
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 02:15:29 +02:00

29 lines
1.9 KiB
Markdown

# v0.7 immutable publication preservation — 2026-10-11
This archive retains exact previously served revision HTML and its original
canonical Markdown. It changes no decision, normative rule or v0.7 source bytes.
The page source commit is ce198fc2905687ea90a2892346b6860281ac87f8; the original
MD SHA-256 is 8155e7b123be1e84377d8278525b1bad8961007b6bb8ff012dd01ba24ff8065b,
and served HTML SHA-256 is 7d7a38a8c3b9fff65b46280fcd5723eff77dc9d0784f871bb35f718bc4e8c0e7.
Current canon MD remains byte-identical. The original MD was independently
extracted from that clean Git commit and compared with current canon.
A clean v0.8 publication build re-rendered v0.7 using new repository HEAD
provenance and therefore changed the immutable page. That failed comparison is
preserved in provenance.json. Earlier local checks had not compared the actual
served bytes. PolicyNexus now explicitly freezes this same-current content
revision, while the canonical v0.7 route may show its superseded notice and
current clean source provenance. Publication manifest pins exact archive hashes;
source/page/provenance mismatch or a changed current MD under revision 0.7 fails
closed, as does a conflicting existing output page. Nothing is hand-edited into
the served HTML. This is local preparation; publication/live verification remains
separate and no serving result is claimed here.
Validation: all 33 PolicyNexus unit checks pass, including new same-current
freeze/new HEAD and source-change refusal regressions. Both new cases fail
against the original helper. An actual 73-document clean build from exact HEAD
exports plus reviewed archive inputs preserves the served7d7a38a8 HTML byte for
byte, retains original ce198fc2 source provenance, shows canonical superseded
notice with current0e17d95 provenance, and serves a separate accepted v0.8 page.
An existing conflicting10a7f7f7 output is rejected without replacing it. See
validation.json for exact hashes, exported inputs and limits.