RubyGems - unaltraweb - Versions diffs - 0.6.0 → 0.7.1 - Mend

unaltraweb 0.6.0 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

checksums.yaml +4 -4
data/Makefile +12 -10
data/docs/_documentation/en/33-reusable-workflows.md +28 -3
data/docs/_documentation/en/40-distribution.md +54 -24
data/docs/_documentation/en/45-retained-documents.md +1 -1
data/docs/_documentation/en/46-live-runtime.md +92 -0
data/docs/agents/d0-runtime-identity.md +209 -0
data/docs/agents/deploy-provenance-86.md +86 -0
data/docs/agents/deployment-integration-0.7.1.md +138 -0
data/docs/agents/mcp-contract.md +13 -4
data/docs/agents/owner-closeout-80.md +185 -0
data/docs/agents/owner-closeout-85.md +269 -0
data/docs/agents/retained-letter-import.md +4 -0
data/scripts/test_wheel_install.py +3 -3
data/scripts/unaltraweb-mcp-bootstrap.sh +90 -9
data/scripts/unaltraweb-mcp-cleanup.sh +41 -9
data/scripts/validate_distribution.py +33 -4
data/scripts/validate_workflows.py +33 -4
data/scripts/web_captures/render.py +8 -1
data/src/unaltraweb_mcp/component-contract.json +52 -26
data/src/unaltraweb_mcp/component-contract.schema.json +35 -2
data/src/unaltraweb_mcp/distribution.py +42 -2
metadata +8 -2

data/scripts/validate_workflows.py CHANGED Viewed

@@ -52,6 +52,9 @@ PYPI_PUBLISH_IMAGE = (
 )
 # Canonical JSON digest of the complete unprivileged verification job.
 PACKAGE_PUBLISH_VERIFY_POLICY_SHA256 = "e8d99c35040770a2b00d3c62497da637739e794310b253d1893078d048d51c48"
+# Canonical JSON of the complete provider-owned PDF digest/producer gate.
+# Extending its reviewed release records also requires published-worker tests.
+DEPLOY_PDF_PROVENANCE_POLICY_SHA256 = "da18b92db4069655e9979308dd90279ea8bfce4b77e47158efd5ac4421e06417"
 IMAGE_WORKFLOWS = {
     "compute-images.yml",
     "docker-image.yml",
@@ -119,14 +122,17 @@ def load_consumer_integration(root: Path) -> dict[str, Any]:
         "manual_pdf_image",
         "vegavisuals_sha",
     }
-    if not isinstance(integration, dict) or set(integration) != required:
+    if not isinstance(integration, dict) or not required <= set(integration) or set(integration) - required - {"site_deploy_workflow_sha"}:
         raise ValueError("component contract has no exact consumer_integration object")
+    integration = dict(integration)
+    integration.setdefault("site_deploy_workflow_sha", integration["core_sha"])
     return integration
 def load_scaffold_deploy(path: Path, integration: dict[str, Any]) -> dict[str, Any]:
     replacements = {
         "CORE_SHA": str(integration["core_sha"]),
+        "SITE_DEPLOY_WORKFLOW_SHA": str(integration["site_deploy_workflow_sha"]),
         "SITE_DEPLOY_WORKFLOW": str(integration["site_deploy_workflow"]),
         "MANUAL_PDF_IMAGE": str(integration["manual_pdf_image"]),
         "VEGAVISUALS_SHA": str(integration["vegavisuals_sha"]),
@@ -213,6 +219,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         integration = {
             "core_sha": "invalid",
             "site_deploy_workflow": "invalid",
+            "site_deploy_workflow_sha": "invalid",
             "manual_pdf_image": "invalid",
             "vegavisuals_sha": "invalid",
         }
@@ -1047,6 +1054,16 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         if marker not in ci_text:
             errors.append(f"ci.yml: missing required check {marker}")
     ci_docker = ci.get("jobs", {}).get("docker", {})
+    published_pdf_gate = _named_step(ci.get("jobs", {}).get("distribution", {}), "Test published PDF deployment provenance")
+    if published_pdf_gate != {
+        "name": "Test published PDF deployment provenance",
+        "env": {
+            "UNALTRAWEB_DEPLOY_PROVENANCE_DOCKER": "1",
+            "UNALTRAWEB_DEPLOY_PROVENANCE_SOURCE_SHA": "${{ github.event.pull_request.head.sha || github.sha }}",
+        },
+        "run": "PYTHONPATH=test python -m unittest test_deploy_provenance.PublishedDeployProvenanceTests",
+    }:
+        errors.append("ci.yml: published PDF deployment provenance must run unconditionally with real Docker")
     ruby_tests = str(_named_step(ci_docker, "Test all Ruby files").get("run") or "")
     if not all(
         marker in ruby_tests
@@ -1362,8 +1379,20 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         for marker in ["MANUAL_PDF_IMAGE", "WORKFLOW_REPOSITORY", "WORKFLOW_SHA", "docker pull", "docker image inspect", "org.opencontainers.image.revision"]:
             if marker not in provenance_text:
                 errors.append(f"site-deploy.yml: PDF worker provenance check missing {marker}")
-        if '[[ "$image_revision" != "$WORKFLOW_SHA" ]]' not in provenance_text:
-            errors.append("site-deploy.yml: PDF worker revision label must be compared with the defining workflow SHA")
+        if '[[ "$image_revision" != "$expected_pdf_revision" ]]' not in provenance_text:
+            errors.append("site-deploy.yml: PDF worker revision label must be compared with its recorded producer SHA")
+        provenance_sha256 = hashlib.sha256(
+            json.dumps(provenance_step, sort_keys=True, separators=(",", ":")).encode()
+        ).hexdigest()
+        if provenance_sha256 != DEPLOY_PDF_PROVENANCE_POLICY_SHA256:
+            errors.append("site-deploy.yml: PDF digest/producer gate differs from the exact reviewed structure")
+        try:
+            contract = json.loads((ROOT / "src/unaltraweb_mcp/component-contract.json").read_text())
+            records = contract["deployment_contract"]["manual_pdf_workers"]
+            if sum(row.get("reference") == integration["manual_pdf_image"] for row in records) != 1:
+                errors.append("site-deploy.yml: selected PDF worker has no reviewed digest/producer record")
+        except (OSError, ValueError, KeyError, TypeError):
+            errors.append("site-deploy.yml: missing or invalid provider deployment records")
         if "docker pull" in provenance_text and "docker image inspect" in provenance_text and provenance_text.index("docker pull") > provenance_text.index("docker image inspect"):
             errors.append("site-deploy.yml: PDF worker digest must be pulled before its revision label is inspected")
         if "${{ github.workflow_sha }}" in deploy_text or "${{ github.workflow_repository }}" in deploy_text:
@@ -1542,7 +1571,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
             action, separator, revision = uses.rpartition("@")
             if not separator or action != integration["site_deploy_workflow"] or not FULL_SHA.fullmatch(revision):
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow must use an immutable unaltraweb SHA")
-            elif revision != integration["core_sha"]:
+            elif revision != integration["site_deploy_workflow_sha"]:
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow SHA has not been reviewed")
             reusable_job = scaffold.get("jobs", {}).get(job_name, {})
             if reusable_job.get("needs") != "validate":

data/scripts/web_captures/render.py CHANGED Viewed

@@ -588,6 +588,8 @@ def internal_network(network: str) -> bool:
 def build_image(image: str) -> None:
     available = inspect_image(image)["available"] == "true"
+    if not available and os.environ.get("UNALTRAWEB_MANAGED_RUNTIME") == "1":
+        raise WebCaptureError("Selected capture image is not prepared; managed execution never pulls")
     if available:
         return
     completed = subprocess.run(["docker", "pull", image], check=False)
@@ -722,6 +724,9 @@ def run_worker(project: Path, image: str, config_path: Path) -> None:
         "project": os.environ.get("UNALTRAWEB_WORKER_PROJECT", "").strip(),
         "token": os.environ.get("UNALTRAWEB_WORKER_TOKEN", "").strip(),
     }
+    session = os.environ.get("UNALTRAWEB_RUNTIME_SESSION", "")
+    if session and not re.fullmatch(r"[0-9a-f]{32}", session):
+        raise WebCaptureError("Invalid runtime session identity")
     worker_args: list[str] = []
     cidfile: Path | None = None
     if any(worker_values.values()):
@@ -739,7 +744,9 @@ def run_worker(project: Path, image: str, config_path: Path) -> None:
             "--label", f"io.context.mcp-worker-token={worker_values['token']}",
         ]
     command = [
-        "docker", "run", "--rm", *worker_args, "--user", f"{os.getuid()}:{os.getgid()}", "--network", network, "--ipc=host",
+        "docker", "run", "--rm", "--pull", "never", *worker_args,
+        *(["--label", f"io.context.mcp-session={session}"] if session else []),
+        "--user", f"{os.getuid()}:{os.getgid()}", "--network", network, "--ipc=host",
         "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "256", "--cpus", "2", "--memory", "2g",
         "--tmpfs", "/tmp:rw,noexec,nosuid,size=512m", "-e", "HOME=/tmp",
         "--mount", docker_bind_mount(project, "/project"), "-w", "/project", image,

data/src/unaltraweb_mcp/component-contract.json CHANGED Viewed

@@ -2,16 +2,42 @@
   "$schema": "component-contract.schema.json",
   "schema_version": 1,
   "release": {
-    "version": "0.6.0",
-    "tag": "v0.6.0"
+    "version": "0.7.1",
+    "tag": "v0.7.1"
   },
   "consumer_integration": {
     "schema_version": 1,
     "core_repository": "https://github.com/dosquartsdedocs/unaltraweb.git",
-    "core_sha": "5cf9817489c8dc47cee726bfe42fe3071cd32b85",
+    "core_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
     "site_deploy_workflow": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml",
-    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
-    "vegavisuals_sha": "68c0b231402ae9485cc34ce530dc5239cb0ec194"
+    "site_deploy_workflow_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
+    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
+    "vegavisuals_sha": "a448cc50a5f511743a6fcfc213baeb9be80f4a27"
+  },
+  "deployment_contract": {
+    "schema_version": 1,
+    "manual_pdf_workers": [
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:9e0b3a45753c170b795e9a9d6df61580085c113436beac5bf6c8de69b6562097",
+        "producer_sha": "d857f8c9f5fea90cf450c0b30b4e77a37b541275"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+        "producer_sha": "5cf9817489c8dc47cee726bfe42fe3071cd32b85"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
+        "producer_sha": "b7ec1d7a139c65b3b0b88699cdbeb19080f13be1"
+      }
+    ],
+    "caller_migrations": [
+      {
+        "id": "deploy-provenance-86",
+        "path": ".github/workflows/deploy.yml",
+        "baseline_sha256": "a789870542614d5817d30ea4328c7d1ad38d27443c009c68a48ad5aaa3106b8e",
+        "current_sha256": "c632a548d0782867be20a2a52fe03469cf63066b7364bace77fd54a226cb3b18"
+      }
+    ]
   },
   "receipt_contract": {
     "schema_version": 1,
@@ -36,10 +62,10 @@
     "gem": {
       "kind": "gem",
       "name": "unaltraweb",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "unaltraweb (= 0.6.0)",
+      "reference": "unaltraweb (= 0.7.1)",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
       "features": ["jekyll-core", "site-build"]
@@ -47,10 +73,10 @@
     "wheel": {
       "kind": "python-wheel",
       "name": "unaltraweb-mcp",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "unaltraweb-mcp==0.6.0",
+      "reference": "unaltraweb-mcp==0.7.1",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": true,
       "features": ["calibre-import", "doctor", "new-web", "offline-inspection", "mcp-control-plane"]
@@ -58,10 +84,10 @@
     "runtime": {
       "kind": "container",
       "name": "unaltraweb runtime",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.6.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.7.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -70,10 +96,10 @@
     "mcp": {
       "kind": "container",
       "name": "unaltraweb MCP runtime",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.6.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-mcp",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -118,10 +144,10 @@
     "manual_pdf": {
       "kind": "container",
       "name": "unaltraweb manual PDF worker",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "released",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -130,10 +156,10 @@
     "diavisuals": {
       "kind": "companion",
       "name": "diavisuals",
-      "version": "0.4.0",
-      "release": "v0.4.0",
+      "version": "0.5.0",
+      "release": "v0.5.0",
       "release_status": "released",
-      "reference": "https://github.com/dosquartsdedocs/diavisuals/releases/download/v0.4.0/diavisuals-0.4.0-py3-none-any.whl#sha256=bfedcc9e2554f25ce4a1c33e556f352210848fccb8da800d1c3900dd86c48c93",
+      "reference": "https://github.com/dosquartsdedocs/diavisuals/releases/download/v0.5.0/diavisuals-0.5.0-py3-none-any.whl#sha256=f52e20f20f1fb3a2418f07adb8d6a68a5567d0c321fb7c0ccc0f4db04917b96b",
       "repository": "https://github.com/dosquartsdedocs/diavisuals",
       "included_in_wheel": false,
       "features": ["mermaid", "plantuml"]
@@ -141,10 +167,10 @@
     "vegavisuals": {
       "kind": "companion",
       "name": "vegavisuals",
-      "version": "0.4.0",
-      "release": "v0.4.0",
+      "version": "0.5.1",
+      "release": "v0.5.1",
       "release_status": "released",
-      "reference": "https://github.com/dosquartsdedocs/vegavisuals/releases/download/v0.4.0/vegavisuals-0.4.0-py3-none-linux_x86_64.whl#sha256=b52ffa743643dd6b5e0320e7a9aa0cd500ea06262b7d5098c0c3f94a379bc0ea",
+      "reference": "https://github.com/dosquartsdedocs/vegavisuals/releases/download/v0.5.1/vegavisuals-0.5.1-py3-none-linux_x86_64.whl#sha256=5aba4f267a37179c520b3cd164e1cec62ac5561872aa33b069cce73442dc52b1",
       "repository": "https://github.com/dosquartsdedocs/vegavisuals",
       "included_in_wheel": false,
       "features": ["vega", "vega-lite"]

data/src/unaltraweb_mcp/component-contract.schema.json CHANGED Viewed

@@ -7,7 +7,7 @@
   "required": ["schema_version", "release", "consumer_integration", "receipt_contract", "wheel_contract", "components"],
   "properties": {
     "$schema": {"type": "string"},
-    "schema_version": {"const": 1},
+    "schema_version": {"type": "integer", "const": 1},
     "release": {
       "type": "object",
       "additionalProperties": false,
@@ -22,14 +22,47 @@
       "additionalProperties": false,
       "required": ["schema_version", "core_repository", "core_sha", "site_deploy_workflow", "manual_pdf_image", "vegavisuals_sha"],
       "properties": {
-        "schema_version": {"const": 1},
+        "schema_version": {"type": "integer", "const": 1},
         "core_repository": {"const": "https://github.com/dosquartsdedocs/unaltraweb.git"},
         "core_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "site_deploy_workflow": {"const": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml"},
+        "site_deploy_workflow_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "manual_pdf_image": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
         "vegavisuals_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
       }
     },
+    "deployment_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "manual_pdf_workers", "caller_migrations"],
+      "properties": {
+        "schema_version": {"type": "integer", "const": 1},
+        "manual_pdf_workers": {
+          "type": "array", "minItems": 1, "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["reference", "producer_sha"],
+            "properties": {
+              "reference": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
+              "producer_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
+            }
+          }
+        },
+        "caller_migrations": {
+          "type": "array", "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["id", "path", "baseline_sha256", "current_sha256"],
+            "properties": {
+              "id": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"},
+              "path": {"const": ".github/workflows/deploy.yml"},
+              "baseline_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"},
+              "current_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"}
+            }
+          }
+        }
+      }
+    },
     "receipt_contract": {
       "type": "object",
       "additionalProperties": false,

data/src/unaltraweb_mcp/distribution.py CHANGED Viewed

@@ -20,7 +20,15 @@ def _strict_json(path: Path) -> Any:
     def reject(value: str) -> None:
         raise ValueError(f"non-finite JSON number is not allowed: {value}")
-    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject)
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result:
+                raise ValueError(f"duplicate component contract key: {key}")
+            result[key] = value
+        return result
+    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject, object_pairs_hook=unique)
 def _schema_type_matches(value: Any, expected: str) -> bool:
@@ -155,6 +163,9 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     expected_workflow = f"{expected_core_repository.removeprefix('https://github.com/').removesuffix('.git')}/.github/workflows/site-deploy.yml"
     if integration["site_deploy_workflow"] != expected_workflow:
         errors.append("consumer integration deploy workflow must belong to the core provider")
+    workflow_sha = str(integration.get("site_deploy_workflow_sha", core_sha))
+    if re.fullmatch(r"[0-9a-f]{40}", workflow_sha) is None or workflow_sha == "0" * 40:
+        errors.append("consumer integration workflow SHA must be a nonzero full lowercase commit SHA")
     expected_pdf_prefix = f"{value['components']['manual_pdf']['image_repository']}@sha256:"
     manual_pdf_image = str(integration["manual_pdf_image"])
     if re.fullmatch(rf"{re.escape(expected_pdf_prefix)}[0-9a-f]{{64}}", manual_pdf_image) is None or manual_pdf_image.endswith("0" * 64):
@@ -162,6 +173,26 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     vegavisuals_sha = str(integration["vegavisuals_sha"])
     if re.fullmatch(r"[0-9a-f]{40}", vegavisuals_sha) is None or vegavisuals_sha == "0" * 40:
         errors.append("consumer integration Vega revision must be a nonzero full lowercase commit SHA")
+    deployment = value.get("deployment_contract")
+    if deployment is not None:
+        references = [row["reference"] for row in deployment["manual_pdf_workers"]]
+        if not 1 <= len(references) <= 64:
+            errors.append("deployment worker inventory must contain between 1 and 64 records")
+        if len(set(references)) != len(references):
+            errors.append("deployment worker references must be unique")
+        if manual_pdf_image not in references or value["components"]["manual_pdf"]["reference"] != manual_pdf_image:
+            errors.append("selected PDF worker must match a reviewed deployment record and the component reference")
+        for row in deployment["manual_pdf_workers"]:
+            if row["producer_sha"] == "0" * 40 or row["reference"].endswith("0" * 64):
+                errors.append("deployment worker identities must be nonzero")
+        migrations = deployment["caller_migrations"]
+        if len(migrations) > 32:
+            errors.append("deployment caller migration inventory exceeds 32 records")
+        if len({row["id"] for row in migrations}) != len(migrations) or len({(row["path"], row["baseline_sha256"], row["current_sha256"]) for row in migrations}) != len(migrations):
+            errors.append("deployment caller migrations must be unique")
+        for row in migrations:
+            if row["baseline_sha256"] == row["current_sha256"] or "0" * 64 in (row["baseline_sha256"], row["current_sha256"]):
+                errors.append("deployment caller migration requires distinct nonzero baseline and current hashes")
     return errors
@@ -194,7 +225,16 @@ def distribution_version() -> str:
 def consumer_integration() -> dict[str, Any]:
     """Return an isolated copy of the reviewed consumer runtime tuple."""
-    return dict(_contract()["consumer_integration"])
+    result = dict(_contract()["consumer_integration"])
+    result.setdefault("site_deploy_workflow_sha", result["core_sha"])
+    return result
+def deployment_contract() -> dict[str, Any]:
+    """Provider-owned identities and exact reviewed caller migrations."""
+    return json.loads(json.dumps(_contract().get("deployment_contract", {
+        "schema_version": 1, "manual_pdf_workers": [], "caller_migrations": [],
+    })))
 def component(component_id: str) -> dict[str, Any]:

metadata CHANGED Viewed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unaltraweb
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.1
 platform: ruby
 authors:
 - dosquartsdedocs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: classifier-reborn
@@ -782,6 +782,7 @@ files:
 - docs/_documentation/en/43-workspace-path-policies.md
 - docs/_documentation/en/44-editorial-review.md
 - docs/_documentation/en/45-retained-documents.md
+- docs/_documentation/en/46-live-runtime.md
 - docs/_documentation/en/50-faq.md
 - docs/_pages/ca/index.md
 - docs/_pages/en/index.md
@@ -799,9 +800,14 @@ files:
 - docs/agents/action-prompts/50-bibliography-entry.txt
 - docs/agents/action-prompts/60-bibliometrics-refresh.txt
 - docs/agents/action-prompts/70-build-and-review.txt
+- docs/agents/d0-runtime-identity.md
+- docs/agents/deploy-provenance-86.md
+- docs/agents/deployment-integration-0.7.1.md
 - docs/agents/manual-authoring-components.md
 - docs/agents/mcp-contract.md
 - docs/agents/owner-closeout-76.md
+- docs/agents/owner-closeout-80.md
+- docs/agents/owner-closeout-85.md
 - docs/agents/owner-followup-76.md
 - docs/agents/owner-preparation-2026-09-29.md
 - docs/agents/quarto-computation-adoption.md