unaltraweb 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ed24da568933de15be12350ea7b867a6aa7e14abac71ec303755f5b808e1837
-  data.tar.gz: a4176d255c14de252144d7669db6479bc43ee033342332cd596870eea1ddf71b
+  metadata.gz: 5697f730a670b00edc9d6cda6bb653552470c6c58667d27557e33309203f552c
+  data.tar.gz: 1fb32fa043262eca9724aed6dc0184246bc6012f2a6261037f03203ef1265945
 SHA512:
-  metadata.gz: 768943c9b012a7e165ab9136d364783203c35caaaae62c2715f95361107f63377dbac30e45252ebeff78b0707d71dd14eb0481cecca18f52b15688c82f4c8c10
-  data.tar.gz: 49edeb75312f6d45e53db50a55a65f25ddb81f7ad8cc8438c9568ada3c9d699c9c00f0a329ea9b8cc2fb5812b5e48acd254e0e967b659d16650a0ea8612dad16
+  metadata.gz: d43c24786b83d17e9cf8cc238eb12227a3d46581fbc550468c95549f9061cd60b6eb4681021855e646929ca41f6b51de850e2db183d956dfd72876b6e48a8a2e
+  data.tar.gz: 15c574473f3c71b81b624b08bf4767902deebfc5f0164abc668f43dae6f33f9a0eb8c4a45e1d734a03bd4540b42b81d4e0a77aa8f42ae46566e7cd81cf7af19f

data/Makefile

@@ -1,9 +1,9 @@
 PYTHON ?= python3
 override PROJECT := $${MCP_CONSUMER_WORKSPACE:?MCP_CONSUMER_WORKSPACE is required}
 override PROJECT_ROOT := $(PROJECT)
-MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.0
-MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0
-MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05
+MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.1
+MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1
+MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677
 MCP_DOCKER_BUILD_NETWORK ?= default
 INIT_SITE_PROFILE ?= unaltreselfie
 NEW_WEB_PROFILE ?= unaltreselfie
@@ -40,8 +40,8 @@ WEB_CAPTURE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-web-capture@sha256:0bf1b
 WEB_CAPTURE_DEV_IMAGE ?= unaltraweb-web-capture:dev
 WEB_CAPTURE_DOCKER_BUILD_NETWORK ?= default
 VEGAVISUALS_CLI ?=
-DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.0
-MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed
+DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.1
+MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
 MANUAL_PDF_DEV_IMAGE ?= unaltraweb-manual-pdf:dev
 MCP_SMOKE_MANUAL_PDF_IMAGE ?= $(MANUAL_PDF_IMAGE)
 MCP_SMOKE_PROJECT ?=

data/docs/_documentation/en/33-reusable-workflows.md

@@ -45,9 +45,34 @@ For `unaltremanual`, the `latest` channel is a manual-only deployment from the r
 
 Clean package scaffolds include a manual GitHub Pages wrapper pinned to a reviewed workflow revision. It has no push deployment trigger: a maintainer runs it only after local checks/renders and human review. The optional integration template retains additional local publishing experiments, but generated sites do not publish from local validation targets.
 
-The `consumer_integration` object in `src/unaltraweb_mcp/component-contract.json` is the single source for the reviewed core revision, workflow path, attested manual PDF image digest, and Vega renderer revision. The scaffold renders that tuple atomically into `Gemfile`, `Gemfile.lock`, and the packaged caller. The caller passes the existing `reviewed_sha` input through to the provider, so the reviewed `main` source is checked independently at both caller and provider boundaries.
-
-This pin-only integration follows the required M -> D -> B order: D was built from M's permanent identity before the caller recorded either value. Repeat that order for future provider updates; never use `@main` or substitute a mutable/version-tagged image for D.
+The `consumer_integration` object in `src/unaltraweb_mcp/component-contract.json` is the single source for the reviewed core revision, workflow path and revision, attested manual PDF image digest, and Vega renderer revision. The scaffold renders that tuple atomically into `Gemfile`, `Gemfile.lock`, and the packaged caller. From 0.7.1, `site_deploy_workflow_sha` is independent of `core_sha`; older records default to their core pin. The caller passes the existing `reviewed_sha` input through to the provider, so the reviewed `main` source is checked independently at both caller and provider boundaries.
+
+The 0.7.1 deployment workflow reads the exact accepted PDF digest and its producer
+commit from the defining provider revision's `deployment_contract` in the BOM.
+It fetches bounded JSON from that immutable provider commit, independently of
+the consumer checkout. It checks the pulled image's revision label against that record, rather
+than assuming the worker and a later workflow revision share a commit. Unknown
+digests fail before Docker access. The reviewed records cover PDF workers 0.5.0
+and 0.6.0; extending them requires a provider review and published-worker tests.
+The records are data in the contract, rather than a release list embedded in the
+workflow program. Release readiness checks the selected workflow's code and own
+records; CI generates a caller and executes the workflow it actually references.
+
+A reviewed deployment-only workflow fix can therefore be pinned independently
+of the site's Gem/core revision while retaining an already-accepted PDF worker.
+Update the caller's `uses:` to the immutable corrected workflow commit, review
+that consumer change, and dispatch with the resulting reviewed `main` SHA. The
+existing Gem, PDF and Vega selections need not change for this workflow repair.
+Such a local caller override remains subject to normal scaffold-update conflict
+review. A later package release can incorporate its own reviewed integration tuple.
+Never use `@main` or a mutable/version-tagged image as a substitute for these pins.
+
+The 0.7.1 update plan recognizes the exact reviewed one-line issue-86 caller fix
+by both its original baseline hash and current content hash. It lists this as a
+`migrations` entry and requires the normal reviewed plan/atomic apply. Additional
+local edits still produce a conflict; authored content and unrelated files are
+preserved. This lets a known provider repair converge to the next managed tuple
+without treating arbitrary custom workflow code as package-owned.
 
 ## Stable manual releases
 

data/docs/_documentation/en/40-distribution.md

@@ -25,18 +25,33 @@ The template is the better place to validate gem consumption, centralized styles
 
 ## Component Contract
 
-### 0.7.0 D0 runtime increment
+### Published 0.7.0 release
 
-The next containing runtime adds [live instance identity and session-scoped
+[**0.7.0**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0)
+adds [live instance identity and session-scoped
 resource control]({{ '/live-runtime/' | relative_url }}). Preparation is explicit,
 launch is pull-never, and startup identity remains distinct from current disk
 metadata. The owner-tested rendering closure selects Diavisuals 0.5.0 and Vega
 0.5.1 with exact artifacts; old 0.4.0 static receipts remain integrity-checked.
-Diavisuals' separate live-process identity correction still gates the full
-managed coordinator closure. Publication and activation evidence belong to the
-[D0 owner record](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/d0-runtime-identity.md).
-
-### Published 0.6.0 release
+The selected Diavisuals 0.5.0 lacks full live-process identity. The provider's
+[0.6.0 correction](https://github.com/dosquartsdedocs/diavisuals/releases/tag/v0.6.0)
+is published, but remains outside this tested Web combination. Full managed
+coordinator acceptance requires composing-owner validation and a new reviewed
+helper selection.
+
+Gem, wheel, base runtime and MCP were produced from
+`b44818c67eecef159f7aa0f825b0416cd511bc43`; receipt integration and tag target
+`9fc84ac7fd01c78c6fe15fe862beb6a5d1633a9e` bind the same-source candidates.
+The post-release checkout launcher selects
+`sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677`.
+Signed-byte D0 acceptance, the retained-letter relocation/rebuild and all four
+populated Bundler roundtrips passed. Public downloads match the receipt.
+The [delivery report](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/owner-closeout-85.md)
+records exact identities and the remaining gates; the
+[D0 owner contract](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/d0-runtime-identity.md)
+defines the native API and lifecycle scopes.
+
+### Previous 0.6.0 release
 
 [**0.6.0**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.6.0)
 delivers native [retained-letter import]({{ '/retained-documents/' | relative_url }}).
@@ -51,7 +66,7 @@ The PDF worker changes to include complete retained documents and the same
 integrity checkers used by its controller. Computation, capture and visual
 companions retain their tested 0.4.0 selections.
 
-The post-release checkout launcher selects published MCP digest
+That release's post-release checkout launcher selected MCP digest
 `sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05`.
 Signed candidates, protected CI, strict receipt/ancestry gates, registry promotion
 and Trusted Publishing passed. Anonymous downloads match the receipt. The
@@ -106,25 +121,25 @@ candidate, receipt, tag and package evidence.
 
 The BOM is an interoperability contract, not a bundle. The wheel contains its Python control/inspection modules, schema/BOM, clean package-owned scaffolds and a small host Docker launcher, described below. It does not include Ruby theme assets, Docker image layers, the factory's build/worker implementations, TeX, Chromium, computation environments, `diavisuals`, or `vegavisuals`.
 
-The selected public core release is `0.6.0`; earlier distributions remain immutable. Its BOM reuses immutable PDF, compute and web-capture worker digests and selects published `diavisuals v0.4.0` and `vegavisuals v0.4.0` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `68c0b231402ae9485cc34ce530dc5239cb0ec194` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
+The selected public core release is `0.7.0`; earlier distributions remain immutable. Its BOM reuses immutable PDF, compute and web-capture worker digests and selects published `diavisuals v0.5.0` and `vegavisuals v0.5.1` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `a448cc50a5f511743a6fcfc213baeb9be80f4a27` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
 
 ## Docker-First Hybrid Policy
 
-### 0.6.0 component selection
+### 0.7.0 component selection
 
-The coordinated core identity is **0.6.0**: gem, wheel, base runtime and MCP
+The coordinated core identity is **0.7.0**: gem, wheel, base runtime and MCP
 images were published together. The installed host launcher and runtime-aware
 generated Bundler state are included. The PDF worker uses its reviewed, signed
-0.6.0 digest, alongside the 0.4.0 computation/capture workers and visual
-companions. A released PDF can be reused only by full digest; new/pending workers
-still require the coordinated version. The historical 0.5.0 receipt remains
-unchanged. Signed image/package evidence is recorded in the 0.6.0 receipt;
+0.6.0 digest, alongside the 0.4.0 computation/capture workers and the accepted
+Diavisuals 0.5.0 / Vega 0.5.1 rendering combination. A released PDF can be reused
+only by full digest; new/pending workers still require the coordinated version.
+Earlier receipts remain unchanged. Signed image/package evidence is recorded in the 0.7.0 receipt;
 promotion and anonymous-download checks passed before the post-release launcher
 pin was advanced.
 
 ### Local delivery
 
-GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.6.0`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
+GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
 
 Factory registration uses a stricter pin. gContExt runs `mcp-build`, which inspects or pulls the full `MCP_RELEASE_IMAGE` digest, and `mcp-stdio` launches that exact image. Checkout builds use local `:dev` names by default through `mcp-image`, `mcp-check` and `mcp-smoke`, so they do not shadow public semver references unless a maintainer explicitly overrides them. The digest is advanced in a separate post-release change after each new receipt exists; candidate source continues to select the last completed release instead of attempting to embed an unknown self-digest.
 
@@ -154,7 +169,7 @@ unaltraweb-mcp-docker serve --project /absolute/consumer
 ```
 
 The installed default selects its package's full MCP release image, currently
-`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.6.0`. It resolves that selection to the
+`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0`. It resolves that selection to the
 local immutable image ID before executing. The checkout's `MCP_RELEASE_IMAGE`
 is a separate digest pin advanced only after publication; it is not the installed
 wheel's default. This avoids sending a new package back to an older MCP while
@@ -299,7 +314,7 @@ For that reason:
 
 ## Docker Runtime
 
-Release `0.6.0` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
+Release `0.7.0` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
 
 The base runtime owns Ruby, Jekyll and system dependencies. The MCP image builds on its exact candidate digest and adds the full reviewed factory plus the Python package. Specialized workers remain separate. This keeps each layer focused without adding Chromium, TeX or computation stacks to every site; the coordinated core-image workflow still rebuilds and verifies runtime, MCP and manual PDF candidates together.
 

data/docs/_documentation/en/46-live-runtime.md

@@ -14,7 +14,8 @@ permalink: /live-runtime/
 nav_title: Live Runtime
 ---
 
-The 0.7.0 runtime increment distinguishes the process serving a connection from
+The [published 0.7.0 runtime](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0)
+distinguishes the process serving a connection from
 the installed package, source checkout and rendering workers. Call
 `runtime_identity` or read `web://runtime-identity` through that live MCP
 connection. Both report the same backend instance and startup information.
@@ -83,7 +84,9 @@ observations without running a renderer.
 Visual helpers are separate MCP processes. Their versions and immutable package
 selections describe the accepted rendering closure, not their current live
 instances. The composing controller must obtain each helper's own live identity.
-The selected Diavisuals 0.5.0 still requires its separately tracked D0 identity
-correction before the entire coordinator closure can be marked managed-ready.
+The selected Diavisuals 0.5.0 lacks full live-process identity. Diavisuals 0.6.0
+publishes the provider correction, but is outside unaltraweb 0.7.0's tested helper
+combination. Composing-owner compatibility validation and a new reviewed selection
+are required before accepting that corrected helper in the managed closure.
 Existing 0.4.0 static provider receipts remain subject to full integrity checks
 and do not force regeneration of authored figures during an upgrade.

data/docs/agents/d0-runtime-identity.md

@@ -6,6 +6,11 @@ Requirements: gaContExt
 Owner issue: [85](https://github.com/dosquartsdedocs/unaltraweb/issues/85).
 Coordination: [gaContExt 15](https://github.com/dosquartsdedocs/gacontext/issues/15).
 
+Delivery: [0.7.0 is published](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0).
+The [signed-byte delivery report](owner-closeout-85.md) supersedes the chronological
+development/candidate state below. It retains the full managed-closure blocker and
+the partial legacy identity gate; publication alone does not close them.
+
 ## Native API mapping
 
 The containing 0.7.0 increment adds `runtime_identity` and
@@ -96,7 +101,7 @@ release while a job continues.
 
 ## Accepted visual-helper points and remaining closure blocker
 
-The candidate selects the published Diavisuals 0.5.0 and Vega 0.5.1 packages:
+Release 0.7.0 selects the published Diavisuals 0.5.0 and Vega 0.5.1 packages:
 
 | Helper | Wheel SHA-256 | Renderer configuration ID |
 | --- | --- | --- |
@@ -118,10 +123,14 @@ by this source change.
 
 The coordinator does not claim to observe another MCP's serving process. Its live
 identity returns the helper selections and requires their independent connection
-observations. **Diavisuals 0.5.0 still lacks the full live-instance identity**;
-[Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14) is therefore
-an external D0 managed-closure blocker. Rendering compatibility alone does not
-close that gate or make the whole coordinator dependency graph managed-ready.
+observations. **Selected Diavisuals 0.5.0 lacks the full live-instance identity**.
+[Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14#issuecomment-5987114002)
+already records the provider correction in published **0.6.0**; the issue remains
+open for intake. That newer provider is outside unaltraweb 0.7.0's tested helper
+point. The remaining gate is composing-owner compatibility acceptance and a new
+reviewed selection of the corrected helper, followed by independent live
+observations. It is not an unpublished provider implementation. Rendering
+compatibility alone does not make the coordinator dependency graph managed-ready.
 
 ## Acceptance and delivery state
 

data/docs/agents/deploy-provenance-86.md

@@ -0,0 +1,86 @@
+# Independent PDF worker provenance — issue 86
+
+[Owner issue 86](https://github.com/dosquartsdedocs/unaltraweb/issues/86) records
+TIG's failed latest deployment at consumer
+`a87eb4fc7fe58f072413a99356d2465b36d05136`. Its published PDF 0.5.0 was produced
+from `d857f8c9f5fea90cf450c0b30b4e77a37b541275`, whereas its reusable workflow
+was pinned to `02af70001bf8085af860fd57f8d7e75ec96a89c7`. Comparing those two
+different component identities blocked the build before Pages publication.
+
+The original gates were re-executed with real published images: canonical 0.5.0,
+0.5.1 and 0.7.0 tuples fail; the 0.6.0 tuple passes because its two revisions
+happen to coincide. Retained diagnostic evidence is
+`/tmp/opencode/unaltraweb-deploy-86/matrix/evidence.json`, SHA-256
+`8640b7b68456b1bce42b9a0a271fe1c4853fde181eff9b3a130c990bd119142f`.
+
+## Corrected trust binding
+
+The reviewed provider workflow now owns these exact digest/producer records:
+
+| PDF worker | OCI digest | Producer commit |
+| --- | --- | --- |
+| 0.5.0 | `sha256:9e0b3a45753c170b795e9a9d6df61580085c113436beac5bf6c8de69b6562097` | `d857f8c9f5fea90cf450c0b30b4e77a37b541275` |
+| 0.6.0 | `sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed` | `5cf9817489c8dc47cee726bfe42fe3071cd32b85` |
+
+Both references use the fixed repository
+`ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf`. The gate first checks the defining
+provider repository and full workflow SHA, rejects an unrecorded digest before
+Docker access, pulls the exact digest and compares its actual revision label
+with the recorded producer. The worker may have been released before the workflow.
+The expected producer is not an input supplied by the consumer, and an inherited
+environment value cannot replace it. Failed pull/inspection stops the step.
+
+The deployment's reviewed-main guard, input interface and publication checks are
+unchanged. The gate uses the already-reviewed immutable artifact identity; this
+change does not introduce or claim a new live signature-verification service.
+Release preparation's existing signed-image evidence remains separate.
+
+Static workflow policy binds the whole gate, including its records and step
+controls, to reviewed canonical JSON. It rejects disabled/error-tolerant gates
+and refuses a BOM default whose worker has no approved record. A new worker
+requires an explicit provider review, updated policy and published-image tests.
+
+## Regression coverage
+
+`test/test_deploy_provenance.py` executes the actual shell blocks from the reusable
+workflow. Unit cases cover earlier legitimate producers, unknown digests with
+plausible labels, mutable/foreign references, missing/wrong labels, a label that
+matches the workflow instead of the worker, attempted expected-revision override,
+foreign/unbound provider authority, pull/inspection failure and reviewed-main
+ref/SHA rejection.
+
+The independently gated Docker case executes real pulls and inspections for both
+published workers against a later workflow revision. The ordinary CI distribution
+job must run this case; static policy rejects silently disabling it:
+
+```bash
+UNALTRAWEB_DEPLOY_PROVENANCE_DOCKER=1 PYTHONPATH=test \
+  python -m unittest test_deploy_provenance.PublishedDeployProvenanceTests
+PYTHONPATH=src python3 -m unittest discover -s test -p 'test_*.py'
+make workflow-check distribution-check
+git diff --check
+```
+
+Local checks passed 619 Python cases, with 30 optional/environment skips, plus
+the explicitly enabled real-Docker case. The actual image configuration IDs were
+`sha256:c1998dc3345444cb3994ac0cd649ad80ac88dde127dec1dd9f09c719aafe170a`
+for PDF 0.5.0 and
+`sha256:d7e7d3243616270fc9e6eed7f8238c412dbe3d9ffc18d2832d17d66ca630d139`
+for PDF 0.6.0. These tests exercise provenance gates without deploying a consumer.
+Protected PR/integration results and the exact delivery commit are recorded in
+issue 86 after integration.
+
+## Urgent consumer adoption
+
+The owner authorized a reviewed workflow-only delivery, independently of a new
+gem/wheel/image release. TIG can retain its approved 0.5.0 Gem/core, PDF digest
+and Vega selection and change only the `deploy.uses` revision in
+`.github/workflows/deploy.yml` to the corrected provider's immutable merge SHA.
+This is a reviewed local caller override; a later scaffold update must preserve
+or explicitly reconcile it rather than resetting it to an older packaged pin.
+
+In the TIG checkout, open the integration PR, verify that the content remains at
+its approved baseline, repeat the local publication checks, merge, then dispatch
+with the exact newly reviewed `main` SHA. Confirm the hosted build, Pages site
+and downloadable PDF. The provider gate proof alone does not replace TIG's full
+311-page manual validation or successful hosted deployment.

data/docs/agents/deployment-integration-0.7.1.md

@@ -0,0 +1,138 @@
+# Consolidated deployment integration — 0.7.1
+
+Owner: [issue 93](https://github.com/dosquartsdedocs/unaltraweb/issues/93), following
+the workflow-only [issue 86 correction](deploy-provenance-86.md). The owner
+authorized implementation, review/integration and gated 0.7.1 publication.
+Current source preparation is distinct from a published distribution; final
+source, receipts, installed-byte evidence and publication are recorded in issue 93.
+
+## One package-owned contract
+
+The BOM now carries two additive schema-v1 fields:
+
+- `consumer_integration.site_deploy_workflow_sha`, independent of the Gem's
+  `core_sha`. Legacy records default to their core revision.
+- `deployment_contract`, with exact `manual_pdf_workers` digest/producer records
+  and bounded `caller_migrations` describing reviewed baseline/current hash pairs.
+
+The package schema and semantic checks validate repository confinement, unique
+records, nonzero identities, the selected PDF's membership and exact migration
+identities. Existing packages, receipts and the issue-86 workflow pin remain
+unchanged. PDF 0.6.0, computation/capture 0.4.0 and the accepted visual-helper
+combination are reused rather than introducing additional component upgrades.
+
+The workflow fetches at most 256 KiB of JSON from its **defining provider commit**
+on the fixed canonical GitHub repository. It does not read a consumer-supplied
+contract or producer SHA. Strict JSON rejects duplicate/non-finite values; records
+have bounded inventory and exact digest/source syntax. Fetch, lookup, pull and
+inspection failures stop publication. A selected immutable digest is checked
+against its recorded producer, not a later workflow commit. Its temporary metadata
+file is invocation-owned and removed on exit.
+
+Static policy binds the generic gate code, while approved artifacts live in the
+contract. Ready-source validation resolves the actual workflow Git pin, checks
+its gate and compares its own producer record with the package selection.
+The CI Docker test additionally creates a package caller and executes the
+preflight blocks of the workflow that caller really selects. Checking only the
+current checkout's YAML is insufficient.
+
+## Reviewed hotfix migration
+
+Only `.github/workflows/deploy.yml` is eligible for the issue-86 migration:
+
+| Identity | SHA-256 |
+| --- | --- |
+| Original package baseline | `a789870542614d5817d30ea4328c7d1ad38d27443c009c68a48ad5aaa3106b8e` |
+| Exact reviewed one-line hotfix | `c632a548d0782867be20a2a52fe03469cf63066b7364bace77fd54a226cb3b18` |
+
+Both must match. The dry-run lists `deploy-provenance-86` in `migrations`, proposes
+the new package-generated caller and binds that authorization to `plan_sha256`.
+The existing confinement, CAS rechecks, private staging, rollback and final
+manifest commit remain in force. Any additional author edit remains a conflict;
+removing the migration authority changes the plan hash. This is not a general
+force-sync or semantic rewrite of authored workflow YAML.
+
+## Acceptance stages
+
+- Unit/schema/workflow tests cover independent core/workflow pins, legacy metadata,
+  invalid or ambiguous records, exact migration, preservation of additional edits,
+  plan binding, provider-only contract acquisition and fail-closed network/Docker
+  errors.
+- `test/test_deploy_provenance.py` tests actual published PDF workers and a generated
+  caller's selected workflow. CI obtains the reviewed source SHA explicitly for
+  source-bound metadata access.
+- `test/deployment_integration_smoke.py` uses installed launchers and owned synthetic
+  manuals: fresh, populated 0.5.0 upgrade and exact reviewed hotfix. It preserves
+  author/cache hashes, applies the reviewed plan, builds PDF/web, probes HTTP and
+  executes the exact remotely pinned workflow's source/provenance gates.
+- Final acceptance must use the downloaded same-source wheel and signed MCP
+  candidate. The driver does not dispatch Pages or claim a hosted real-manual
+  deployment. TIG's authorized deployment is a separate consumer-session proof.
+
+The implementation is integrated before the containing source selects its final
+reviewed core/workflow revisions. Candidate components remain pending until that
+selection; release readiness and publication keep their existing strict receipt,
+ancestry, signing and immutable-byte gates.
+
+## Reviewed source selection
+
+Implementation `2133b8fa2f668e14d603a36d15584eed63e4386a` is integrated through
+[PR 94](https://github.com/dosquartsdedocs/unaltraweb/pull/94) at
+`2ff27f27c274eb09b2c53ef8bd374f333702d8ee`. PR CI `37526811887` and CodeQL
+`37526811747` passed, including actual provider-record acquisition and generated
+caller provenance checks. The review is agent-attributed.
+
+The containing candidate now selects this integration for both independent
+core/workflow fields and marks gem, wheel, runtime and MCP ready for same-source
+candidate preparation. The selected workflow's own contract records the reused
+PDF 0.6.0 producer correctly; no worker version change is needed.
+
+Local source validation passed 629 cases with 31 optional/environment skips,
+fresh-wheel and owned-image MCP checks/smoke, docs and prose checks. The installed
+development new/upgrade/hotfix manual proof is retained at
+`/tmp/opencode/unaltraweb-071-93/local-integration/evidence.json`, SHA-256
+`d98c0fb56d2b74839a7132cc9dc7ab3f65a9802087837af1a13070a51316a14a`.
+That development proof still used the earlier reviewed workflow pin; final
+signed-candidate acceptance must exercise the now-selected integration above.
+
+## Final-byte gate: retained-document worker closure
+
+The first candidates from `b7ec1d7a139c65b3b0b88699cdbeb19080f13be1` passed normal
+manual upgrades but failed retained-Carta freshness with the reused PDF 0.6.0.
+The manifest fingerprints `artifact_imports.CHECKER_FILES`, including the changed
+distribution module and component schema. Successful PDF generation alone was
+not sufficient: the old worker and new controller calculated different identities.
+Those first core candidates are retained diagnostic evidence and are not promoted
+as the 0.7.1 release.
+
+The signed PDF specialization already built/tested by run `37530306398` contains
+the matching 0.7.1 checker closure:
+`ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+Its configuration ID is
+`sha256:618163d3f924439792b2306617bd9612f566c5881166102fa544b4e782d569fa`,
+its producer revision is the first candidate source above and its native package
+reports 0.7.1. The changed checker files match the controller byte for byte.
+
+A local controller overlay selecting only that exact worker passed the complete
+Carta import, copied-producer retirement, receiver relocation and forced PDF
+rebuild. Both 11-page PDFs have hash
+`eb693ced023efafe36a926dd38a1bf1c85399a1b114551cc0ff32e652144c496`; original Carta
+bytes remain unchanged. Diagnostic evidence:
+`/tmp/opencode/unaltraweb-071-93/pdf071-carta-probe/evidence.json`, SHA-256
+`c076f988e43ddb474132e58f5027931085bd734242757b84fb50289ef68cde25`.
+The overlay is not a signed final MCP identity.
+
+The worker record is integrated before a follow-up selection pins its containing
+workflow and PDF. Core components return to pending during this preparation.
+Ready-source CI now requires the exact selected core, controller and PDF worker
+to agree on every retained-document checker file. This catches this class of
+incompatibility before final publication; the final signed core candidates must
+still repeat the complete composed acceptance.
+
+The producer record and checker-closure regression were integrated through
+[PR 96](https://github.com/dosquartsdedocs/unaltraweb/pull/96) at
+`3332e0b93933f12317e05f1ce8d38ce80046feab`. This is the final reviewed core/workflow
+selection. The tuple selects the verified PDF specialization above as 0.7.1,
+published by its immutable digest, and the four core components return to ready.
+Their new same-source candidates replace the rejected first core tuple in the
+eventual release receipt. No earlier release or worker is overwritten.

data/docs/agents/mcp-contract.md

@@ -1,9 +1,10 @@
 # MCP Contract
 
-The D0 additions require a containing 0.7.0 runtime. Their pinned requirements,
+The D0 additions ship in the published 0.7.0 runtime. Their pinned requirements,
 exact API mapping, lifecycle scopes and external helper-identity blocker are
 documented in [the owner contract](d0-runtime-identity.md). A source descriptor
-does not upgrade an already-running 0.6.0 connection.
+does not upgrade an already-running 0.6.0 connection. Exact public identities and
+installed acceptance are recorded in [the delivery report](owner-closeout-85.md).
 
 `unaltraweb` exposes one global, on-demand stdio MCP server for website workspaces. Every client session starts an independently named Dockerized MCP process and mounts its current consumer project at `/workspace` and at its canonical host path. Stable factory, role, and project labels preserve project-scoped lifecycle control without forcing concurrent sessions to share a deterministic container name. The image includes both FastMCP and the Jekyll runtime, so the host does not need Python, the optional `mcp` package, Ruby, or Bundler.
 
@@ -37,8 +38,8 @@ it to an image ID before execution. The source checkout's digest pin is separate
 it advances only after a new receipt exists. Explicit `--image` (or the console
 adapter's `UNALTRAWEB_MCP_IMAGE`) permits a reviewed immutable selection.
 
-The post-release checkout pin selects published 0.6.0 MCP digest
-`sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05`.
+The post-release checkout pin selects published 0.7.0 MCP digest
+`sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677`.
 Existing processes keep their running image until clients reconnect. Site build
 defaults and customized Makefiles remain separate, explicitly reviewed selections.
 

data/docs/agents/owner-closeout-85.md

@@ -0,0 +1,269 @@
+# unaltraweb 0.7.0 D0 delivery closeout
+
+Published **2026-10-05 21:45:13 UTC**:
+[v0.7.0](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0).
+Owner: [issue 85](https://github.com/dosquartsdedocs/unaltraweb/issues/85).
+Coordination: [gaContExt 15](https://github.com/dosquartsdedocs/gacontext/issues/15).
+Requirements: gaContExt `5634ea2e3e42122bb365992dfca9f248feb89dec`.
+This report supersedes the chronological candidate state in the
+[native API contract](d0-runtime-identity.md).
+
+## Review and exact source
+
+The owner explicitly authorized the complete review/PR/integration, gated
+publication and separate post-release checkout pin. Work used only
+`/home/benizar/git/unaltraweb`, ordinary serial branches and synthetic consumers.
+Existing releases, authored state and unrelated client registrations were retained.
+
+| Role | Revision / evidence |
+| --- | --- |
+| Reviewed D0 implementation | `0c87e8c276e58ac9c747833df69cdb439aa6132b` |
+| Integrated core selected by consumers | `216ab2e8b6b8b45a5bb7da0a54bffd10edee895d`, [PR 87](https://github.com/dosquartsdedocs/unaltraweb/pull/87) |
+| Core selection commit | `2881a37dd6e5071d71c30cb44aa9af6faba5e886` |
+| Final artifact-producing source | `b44818c67eecef159f7aa0f825b0416cd511bc43`, [PR 88](https://github.com/dosquartsdedocs/unaltraweb/pull/88) |
+| Receipt-only child | `6dc13638c49bfb53a1c456e9e6b30aec7b3fd713` |
+| Receipt integration / tag target | `9fc84ac7fd01c78c6fe15fe862beb6a5d1633a9e`, [PR 89](https://github.com/dosquartsdedocs/unaltraweb/pull/89) |
+| Annotated tag object | `28a2a40b4b633be2fefb3f1c753cf95db1c7bdf6` |
+| Reviewed post-release pin / report | `7f9ce5b3bd844aed3a820c98f9712b7cfc8c23ea` |
+| Post-release integration | `833c5548ff01801097ddd56114d9039fd3914a43`, [PR 90](https://github.com/dosquartsdedocs/unaltraweb/pull/90) |
+
+Review records are explicitly agent-attributed, not human approval. The receipt
+integration's first parent is the artifact source; its first-parent diff contains
+only `release-candidates.json`. Native package authorization, exact staging,
+strict distribution/publication-ref checks and annotated-tag verification passed
+before privileged publication. These release checks apply to the receipt/tag
+revision, not later ordinary post-release commits.
+
+## Receipt, packages and images
+
+[Tagged receipt](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.7.0/release-candidates.json):
+schema 1, source `b44818c67eecef159f7aa0f825b0416cd511bc43`, SHA-256
+`92b4feafbf822ff5b0d9fc6534f963e68c2a28a875d4e2e841c051e7c619e7dc`.
+It contains exactly the four components marked `ready` in the source BOM.
+
+| Component | Artifact / repository | SHA-256 / OCI index digest |
+| --- | --- | --- |
+| Gem | `unaltraweb-0.7.0.gem` | `1f4c71fc03bc3025018873eae73f7a2274e46b87ac678805e4150b8351b9ff0c` |
+| Wheel | `unaltraweb_mcp-0.7.0-py3-none-any.whl` | `3c9cd477e8c2fa0f69c1309c9302b110b73032600e8cf040c4818169863dd868` |
+| Base runtime | `ghcr.io/dosquartsdedocs/unaltraweb` | `sha256:ce67aa8fb90899e3c770c4ec8952b760cc8cafb3ed203e8e15266a9623bb3d31` |
+| MCP | `ghcr.io/dosquartsdedocs/unaltraweb-mcp` | `sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677` |
+
+Both OCI aliases `0.7.0` and `v0.7.0` were inspected anonymously and match these
+digests. Local Linux/amd64 configuration IDs are distinct:
+
+- Runtime: `sha256:beec5459bc7aa159af428fbad5d14a4527f3143e5062ec305a00619c31aae706`.
+- MCP: `sha256:b03e463343abcd0d5891f68ec423256f970d7c1fb35dc875e089e0f745cfe39a`.
+
+Their revision labels equal the artifact source. The image workflow verified
+GitHub-signed provenance, signer workflow, source revision and labels before
+executing the exact candidates. Semver promotion reverified those identities and
+reused the tested manifests without rebuilding.
+
+The package workflow artifact is `11329540867`, named
+`unaltraweb-0.7.0-b44818c67eecef159f7aa0f825b0416cd511bc43`; its archive digest is
+`sha256:9af51fb8447cf77691ffd362a752b247a9a1ee45a351f44b8de8ac60d62317c9`.
+The publisher authorized the exact successful run, source and inventory, then
+verified/staged the recorded hashes. Separate OIDC jobs published those bytes.
+Anonymous PyPI/RubyGems metadata and downloads match them. Downloaded GitHub
+Release assets also pass `SHA256SUMS`, whose SHA-256 is
+`4abdefd44dd6cce44262fd19e224a54ca7a1d1b7ada66071d5b737d94f9270ab`.
+
+## Reused workers and accepted helpers
+
+The selected PDF remains the published, signed 0.6.0 specialization:
+`ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed`.
+Its configuration ID is
+`sha256:d7e7d3243616270fc9e6eed7f8238c412dbe3d9ffc18d2832d17d66ca630d139`.
+It is `released`, outside the four-component receipt. The source-bound workflow
+also tested PDF candidate
+`sha256:d6d866cd16eab156e7dc3fea2fd7e649d8b91dca2916b45cd5c2218184d5928b`;
+that verification-only candidate received no 0.7.0 semver promotion and is not
+the selected worker.
+
+Computation and capture keep their 0.4.0 immutable BOM references. The retained D0
+observation reports Python compute as prepared; R compute and web capture were
+locally missing and remained explicitly `missing`, without fallback. This
+acceptance executes web/manual-PDF work, not every optional computation/capture
+workflow. An adapter enabling those features must prepare and verify their exact
+workers separately.
+
+| Accepted helper | Wheel SHA-256 | Renderer configuration ID |
+| --- | --- | --- |
+| Diavisuals 0.5.0 | `f52e20f20f1fb3a2418f07adb8d6a68a5567d0c321fb7c0ccc0f4db04917b96b` | `sha256:5a6887b372a0e1c386a7b54981d11ae1910215baeb6a12dfd0706b3e85ef0846` |
+| Vega 0.5.1 | `5aba4f267a37179c520b3cd164e1cec62ac5561872aa33b069cce73442dc52b1` | `sha256:695125943d0fbc3aa7c877babb9a11a6501bbc7ac265b0975bb5657c60439d98` |
+
+Native selection uses Diavisuals `--runtime-image` / `--runtime-expected-id` and
+Vega `--renderer-image-id`. Actual Mermaid, PlantUML, Vega-Lite/CSV and Vega renders
+passed receipt verification, tamper refusal and consumer relocation. Existing
+renderer aliases were unchanged. Exact 0.4.0 static receipt compatibility retains
+all input/output/request integrity checks; no continuous version range is inferred.
+
+## Live identity and installed acceptance
+
+The actual serving process provides `runtime_identity` and
+`web://runtime-identity`; both agreed on the backend instance. Native profile
+`unaltraweb-docker-stdio-v1` uses one connection per backend, one operation at a
+time, explicit drain and scoped orphan recovery. Host commands `session-status`
+and `reap-session` consume the retained consumer/session/container tuple.
+
+The initial accepted backend instance was `400244b6784c46498aadd3ec3b9c088f`, with
+inner PID 7 in `pid:[4026533734]`, start ticks `65541450`, Python 3.13.5 and
+executable `/usr/bin/python3`. Container
+`3feb725c68984e69fe208d56bdf06ec2dfcff4d43f1071045ebc0eadf3779ffe` had daemon init
+PID `3938960`; these PIDs belong to different namespaces. The canonical consumer
+binding was `/tmp/opencode/unaltraweb-d0-85/candidate-d0-proof/consumer A`.
+Reconnection produced instance `9c9d94e47c324be89abff5e80defb024` while the second
+consumer retained instance `413e89f4ebd34e5d8570b1db6a8360af`.
+
+The installed engine root was `/usr/local/lib/python3.13/dist-packages/unaltraweb_mcp`.
+Loaded version 0.7.0 and startup code fingerprint
+`5fdfb154f82d01bb5dcc5a35d74ba2f384b36e60a5111b63831b6216adfb8996` remained fixed
+when metadata in the disposable container overlay changed to 99.0.0. Current
+bytes reported drift; the prepared image was unchanged. Observed canonical
+component-contract hash:
+`d2cddda50780f00ec3af47826a93341e014d4811146195ed09a9bf1ee5fcdf81`;
+profile hash:
+`6c9305143f2f5e3dee831f3d5bf2b5413e51f24e3f28310fa21019c645532481`.
+Selection hashes additionally bind each consumer/worker tuple and are retained in
+the evidence. These observations are not permanent process attestations.
+
+`test/d0_runtime_smoke.py` passed all eight stages against the downloaded CI wheel
+and signed MCP: reconnect/scope, loaded-versus-disk, busy drain, backend-crash
+recovery, offline launch, explicit nested daemon mapping, wrong worker and missing
+worker. Wrong/missing controller images were also refused. A real PDF job was
+observed **busy after backend death**; recovery waited until it became eligible,
+then proved resource absence while another live backend remained connected.
+EOF/drain released only the retired session's resources.
+
+The real 0.6.0 → 0.7.0 → 0.6.0 roundtrip preserved authored files and old generated
+cache entries. The unrelated registration sentinel retained SHA-256
+`2705c6065bbc5665798be533b1057070b6efeae289cab3e800579cb6b5608afb`.
+The historical 0.6.0 process lacks live identity and remains an explicitly
+**partial** point, not a second D0-capable release.
+
+## Retained Carta and populated Bundler regressions
+
+`test/artifact_import_smoke.py` consumed the authenticated published Carta packet.
+Bundle hash `aeaa757ee1be19bfe56dc9af8dd1178032929b4a2bec2dad2ebb621b158ad999`
+and the 12-file seal remain intact. The mapping from `payload/output/letter.pdf`
+to `assets/documents/carta.pdf` retains original PDF hash
+`4a661740a18fe1cf75b84aa0d8532511fd105eb5484a5af700e11e8e30828ea4`.
+Integration record hash:
+`995e213e9c5677763809b4d108b84882e1821be58796e0823b8260c22f891a18`.
+
+The copied producer and incoming tree were removed, author prose survived
+reimport, and the receiver moved before native/generic checking and a forced PDF
+rebuild. Web/HTTP passed at both locations. Both 11-page PDFs have SHA-256
+`026552039659771d73a26875dc628c5dbccb8da2d4c32bcf0a199929efdd60e2`; the unchanged
+letter appears on page 10. Generic verification confirmed one bundle, one mapping
+and 14 files; the native checker also bound the chapter and rendered page.
+
+`test/bundler_transition_smoke.py` passed all four profiles using actual immutable
+0.4.0, unpatched 0.5.0 and new 0.7.0 MCP references. The known failure was
+reproduced on a separate copy. Each 0.7.0 activation and return to 0.4.0 passed
+two builds and a preview. All six author/cache files kept their hashes, with no
+cache clearing. `test/published_companion_smoke.py` passed with the published
+helper wheels and explicit renderer IDs above. The downloaded CI gem passed
+`scripts/test_gem_build.py:inspect_gem`, including isolated native helper closure.
+
+## CI and retained evidence
+
+| Gate | Successful run |
+| --- | --- |
+| Implementation PR CI / CodeQL | [37271200816](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37271200816) / [37271200817](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37271200817) |
+| Core selection PR CI / CodeQL | [37272201763](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272201763) / [37272201726](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272201726) |
+| Final artifact source CI / CodeQL | [37272717370](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272717370) / [37272717381](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272717381) |
+| Signed candidate image build/test | [37273192732](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37273192732) |
+| Package preparation | [37273195884](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37273195884) |
+| Receipt PR CI / CodeQL | [37371882737](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37371882737) / [37371882776](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37371882776) |
+| Receipt integration CI / CodeQL | [37375549493](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37375549493) / [37375549627](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37375549627) |
+| Tag CI | [37376786630](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37376786630) |
+| Semver image promotion | [37377435437](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37377435437) |
+| PyPI/RubyGems Trusted Publishing | [37377438226](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37377438226) |
+| Post-release PR CI / CodeQL | [37379728022](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37379728022) / [37379728286](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37379728286) |
+| Post-release integration CI / CodeQL | [37380436187](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37380436187) / [37380436184](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37380436184) |
+
+Two first-attempt receipt PR jobs were not acquired by hosted runners and ran no
+steps. Their retry passed without source changes; original attempts remain in
+the local evidence. The local source suite passed 608 Python cases, with 30
+optional/environment skips. No failed job was bypassed for merge or publication.
+
+Evidence root: `/tmp/opencode/unaltraweb-d0-85/`.
+
+| Retained result | SHA-256 |
+| --- | --- |
+| `image-evidence/tested-images.json` | `6c38a1d08511d0cb6554905bc236de58a9f594b255553361d36e6caa4622335d` |
+| `candidate-d0-proof/evidence.json` | `e8140ef8cf47e4329f7691b8a3733377a17269b83c2cf2e9b444c94ce22621f6` |
+| `candidate-carta-proof/evidence.json` | `c1b12f80b1a3c0d31a83fa015f050f0897923ef578ecac9c20f95e4acaa6fca0` |
+| `candidate-bundler-proof/evidence.json` | `8206e1a9e4a88123390dad30ba314d0b2fa00820a5af426164f060050be3ab4d` |
+| `candidate-helpers-proof/evidence.json` | `df994ccd8afaff45a7e3cfa9b6a29b650c9d01d63db2c9c36e59c31834273473` |
+| `published-packages/verified.json` | `e892bbb22c35ea3eef3b2abbbd6351e4a290e76d322c91ac3de6fb212965909f` |
+| `public-images.json` | `f123c2dc096405bde004cfd6cbce206a0f56925f436731e575830cf111d26314` |
+| `post-pin-proof/evidence.json` | `0944b95eec8d0e1103f4895595c77780d27ebc1a3e64626f421b960be8efd144` |
+
+## Public installation and checkout selection
+
+A fresh public-wheel venv passed default `prepare`, `check` and real stdio
+`smoke`, with the expected MCP configuration ID. That public installation also
+rechecked the relocated Carta source/rendered mapping. The public gem installed
+in an isolated gem home and activated as 0.7.0 with the runtime's existing Ruby
+dependencies, including Ruby's default gem paths; this is not a network-fresh
+dependency installation claim.
+
+The separate `chore/85-pin-published-mcp-0.7.0` source change selects the published
+digest in Make/bootstrap and updates its existing pin regression and current docs.
+It does not alter the published BOM, receipt, tag or artifact bytes. PR 90 and its
+integration passed protected CI; the resulting main checkout was clean and
+synchronized. The later helper-intake clarification is documentation-only.
+
+The actual `MCP_CONSUMER_WORKSPACE=… make mcp-stdio` transport started a synthetic
+consumer with live instance `2ebdbd20c32649c48bf309dc469f2c8b`. Tool/resource
+identity agreed, loaded 0.7.0 and the published image matched, and drain/close
+followed by exact retained-tuple inspection confirmed resource release.
+`make mcp-build` and the bootstrap's `--check` selected that public image directly.
+
+Post-pin local checks passed 608 Python cases (579 passed, 29 optional skips),
+`make distribution-check workflow-check`, the fresh `make wheel-check`, prose
+checks, `editorial-publication-check` and `git diff --check`. The prose checker
+reported only existing informational sentence-length cues, not blocking findings.
+The source Make targets were exercised with independently owned development names:
+
+```bash
+make mcp-check mcp-smoke \
+  MCP_RUNTIME_IMAGE=unaltraweb-d0-85-runtime:post-pin \
+  MCP_IMAGE=unaltraweb-d0-85-mcp:post-pin \
+  MANUAL_PDF_DEV_IMAGE=unaltraweb-d0-85-pdf:post-pin \
+  MCP_SMOKE_MANUAL_PDF_IMAGE=ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed
+make docs-build \
+  DOCKER_IMAGE=ghcr.io/dosquartsdedocs/unaltraweb@sha256:ce67aa8fb90899e3c770c4ec8952b760cc8cafb3ed203e8e15266a9623bb3d31
+```
+
+Both commands passed. Development outputs remain separate from the signed
+artifact acceptance and did not replace public semver images or retained caches.
+
+## Remaining gates and scope
+
+**The complete coordinator dependency graph is not declared managed-ready.**
+Selected Diavisuals 0.5.0 lacks full serving-process identity. The
+[provider return in Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14#issuecomment-5987114002)
+records that **Diavisuals 0.6.0 already published the native correction on
+2026-10-05 at 02:25:02 UTC**, from `1c2dd8c8138e27bcdb1b0fee1fd51e1d057130e3`.
+Its live mapping is `server_identity` / `diavisuals://server/identity`, with its
+own lifecycle. The open issue tracks acceptance/intake, not missing publication.
+
+Unaltraweb 0.7.0 was tested and published with 0.5.0. The outstanding composition
+gate is therefore **owner acceptance of the corrected helper and a new reviewed
+selection**, not another claim that the provider correction has yet to ship.
+The hub cannot widen the published 0.7.0 helper pin from metadata alone. It must
+also observe each independent helper process, prepare feature-specific workers
+and accept the native adapter before activation. This clarification does not
+change the released BOM or count Diavisuals 0.6.0 as tested Web compatibility.
+
+The acceptance platform is Linux/amd64 and the claimed backend profile is Docker
+stdio, one connection per instance. Shared HTTP backend reattachment and a fully
+D0-capable two-release roundtrip are not claimed. Arbitrary direct controller
+layouts remain [issue 31](https://github.com/dosquartsdedocs/unaltraweb/issues/31);
+only canonical host and explicitly mapped nested launchers were proved. Retained
+Carta coverage is the published English one-page leaf, not Diapora composition.
+Real manuals, author artifacts and existing client registrations were not migrated.
+Already-running clients retain their loaded runtime until explicit reconnection.

data/scripts/test_wheel_install.py

@@ -290,7 +290,7 @@ def main() -> int:
                 raise RuntimeError(f"generated {profile} Gemfile does not use the reviewed core revision")
             if f'revision: {integration["core_sha"]}' not in lockfile:
                 raise RuntimeError(f"generated {profile} lockfile does not use the reviewed core revision")
-            if f'uses: {integration["site_deploy_workflow"]}@{integration["core_sha"]}' not in deploy:
+            if f'uses: {integration["site_deploy_workflow"]}@{integration["site_deploy_workflow_sha"]}' not in deploy:
                 raise RuntimeError(f"generated {profile} deploy caller does not use the reviewed core revision")
             if f'manual-pdf-image: "{integration["manual_pdf_image"]}"' not in deploy:
                 raise RuntimeError(f"generated {profile} deploy caller does not use the reviewed PDF image")

data/scripts/unaltraweb-mcp-bootstrap.sh

@@ -15,7 +15,7 @@ Managed mode requires an immutable reference or an expected full image ID.
 USAGE
 }
 
-image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05}"
+image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677}"
 project="${MCP_CONSUMER_WORKSPACE:-${UNALTRAWEB_PROJECT:-}}"
 operation=serve
 expected_image="${UNALTRAWEB_EXPECTED_IMAGE_ID:-}"

data/scripts/validate_distribution.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import os
 import re
@@ -39,7 +40,7 @@ from unaltraweb_mcp.distribution import (  # noqa: E402
     is_mutable_reference,
     validate_component_contract,
 )
-from scripts.validate_workflows import load_workflow_text, reusable_deploy_input_errors  # noqa: E402
+from scripts.validate_workflows import DEPLOY_PDF_PROVENANCE_POLICY_SHA256, load_workflow_text, reusable_deploy_input_errors  # noqa: E402
 
 
 def load_yaml(path: Path) -> dict[str, Any]:
@@ -88,6 +89,21 @@ def component_version_errors(contract: dict[str, Any]) -> list[str]:
     return errors
 
 
+def selected_deployment_errors(contract: dict[str, Any], workflow: dict[str, Any], provider_contract: dict[str, Any]) -> list[str]:
+    """Release readiness binds the called workflow's code and data, not local YAML."""
+    errors = []
+    steps = workflow.get("jobs", {}).get("build", {}).get("steps", [])
+    step = next((row for row in steps if row.get("name") == "Verify manual PDF image provenance"), {})
+    if hashlib.sha256(json.dumps(step, sort_keys=True, separators=(",", ":")).encode()).hexdigest() != DEPLOY_PDF_PROVENANCE_POLICY_SHA256:
+        errors.append("selected deployment workflow does not contain the reviewed contract-driven provenance gate")
+    reference = contract["consumer_integration"]["manual_pdf_image"]
+    expected = [row for row in contract.get("deployment_contract", {}).get("manual_pdf_workers", []) if row.get("reference") == reference]
+    actual = [row for row in provider_contract.get("deployment_contract", {}).get("manual_pdf_workers", []) if row.get("reference") == reference]
+    if len(expected) != 1 or actual != expected:
+        errors.append("selected deployment workflow's producer record differs from the package's PDF identity")
+    return errors
+
+
 def validate(root: Path = ROOT) -> list[str]:
     errors: list[str] = []
     contract = distribution_contract()
@@ -125,6 +141,11 @@ def validate(root: Path = ROOT) -> list[str]:
         errors.append(f"component contract schema validation failed: {exc}")
     errors.extend(f"component contract semantic validation failed: {error}" for error in component_contract_semantic_errors(contract))
     core_sha = str(contract["consumer_integration"]["core_sha"])
+    workflow_sha = str(contract["consumer_integration"].get("site_deploy_workflow_sha", core_sha))
+    workflow_ancestor = subprocess.run(["git", "merge-base", "--is-ancestor", workflow_sha, "HEAD"], cwd=root,
+                                       stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+    if workflow_ancestor.returncode != 0:
+        errors.append("consumer integration workflow SHA must be an ancestor of the current source")
     core_object = subprocess.run(
         ["git", "cat-file", "-e", f"{core_sha}^{{commit}}"],
         cwd=root,
@@ -145,7 +166,7 @@ def validate(root: Path = ROOT) -> list[str]:
         if core_ancestor.returncode != 0:
             errors.append("consumer integration core SHA must be an ancestor of the current source")
         pinned_workflow = subprocess.run(
-            ["git", "show", f"{core_sha}:.github/workflows/site-deploy.yml"],
+            ["git", "show", f"{workflow_sha}:.github/workflows/site-deploy.yml"],
             cwd=root,
             text=True,
             stdout=subprocess.PIPE,
@@ -153,7 +174,7 @@ def validate(root: Path = ROOT) -> list[str]:
             check=False,
         )
         if pinned_workflow.returncode != 0:
-            errors.append("consumer integration core SHA does not contain the reusable deploy workflow")
+            errors.append("consumer integration workflow SHA does not contain the reusable deploy workflow")
         else:
             try:
                 pinned_deploy = load_workflow_text(pinned_workflow.stdout)
@@ -164,6 +185,14 @@ def validate(root: Path = ROOT) -> list[str]:
                     f"consumer integration workflow: {error}"
                     for error in reusable_deploy_input_errors(pinned_deploy)
                 )
+                if "deployment_contract" in contract and contract["components"]["mcp"]["release_status"] == "ready":
+                    recorded = subprocess.run(["git", "show", f"{workflow_sha}:src/unaltraweb_mcp/component-contract.json"],
+                                              cwd=root, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+                    try:
+                        provider_contract = json.loads(recorded.stdout) if recorded.returncode == 0 else {}
+                        errors.extend(selected_deployment_errors(contract, pinned_deploy, provider_contract))
+                    except (ValueError, KeyError, TypeError):
+                        errors.append("selected deployment workflow has no valid provider-owned component contract")
     if schema.get("properties", {}).get("schema_version", {}).get("const") != 1:
         errors.append("component contract schema does not select version 1")
 
@@ -273,7 +302,7 @@ def validate(root: Path = ROOT) -> list[str]:
         "Makefile.tmpl": ["__MCP_IMAGE__", "__MANUAL_PDF_IMAGE__"],
         ".github/workflows/deploy.yml.tmpl": [
             "__SITE_DEPLOY_WORKFLOW__",
-            "__CORE_SHA__",
+            "__SITE_DEPLOY_WORKFLOW_SHA__",
             "__MANUAL_PDF_IMAGE__",
             "__VEGAVISUALS_SHA__",
         ],

data/scripts/validate_workflows.py

@@ -52,6 +52,9 @@ PYPI_PUBLISH_IMAGE = (
 )
 # Canonical JSON digest of the complete unprivileged verification job.
 PACKAGE_PUBLISH_VERIFY_POLICY_SHA256 = "e8d99c35040770a2b00d3c62497da637739e794310b253d1893078d048d51c48"
+# Canonical JSON of the complete provider-owned PDF digest/producer gate.
+# Extending its reviewed release records also requires published-worker tests.
+DEPLOY_PDF_PROVENANCE_POLICY_SHA256 = "da18b92db4069655e9979308dd90279ea8bfce4b77e47158efd5ac4421e06417"
 IMAGE_WORKFLOWS = {
     "compute-images.yml",
     "docker-image.yml",
@@ -119,14 +122,17 @@ def load_consumer_integration(root: Path) -> dict[str, Any]:
         "manual_pdf_image",
         "vegavisuals_sha",
     }
-    if not isinstance(integration, dict) or set(integration) != required:
+    if not isinstance(integration, dict) or not required <= set(integration) or set(integration) - required - {"site_deploy_workflow_sha"}:
         raise ValueError("component contract has no exact consumer_integration object")
+    integration = dict(integration)
+    integration.setdefault("site_deploy_workflow_sha", integration["core_sha"])
     return integration
 
 
 def load_scaffold_deploy(path: Path, integration: dict[str, Any]) -> dict[str, Any]:
     replacements = {
         "CORE_SHA": str(integration["core_sha"]),
+        "SITE_DEPLOY_WORKFLOW_SHA": str(integration["site_deploy_workflow_sha"]),
         "SITE_DEPLOY_WORKFLOW": str(integration["site_deploy_workflow"]),
         "MANUAL_PDF_IMAGE": str(integration["manual_pdf_image"]),
         "VEGAVISUALS_SHA": str(integration["vegavisuals_sha"]),
@@ -213,6 +219,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         integration = {
             "core_sha": "invalid",
             "site_deploy_workflow": "invalid",
+            "site_deploy_workflow_sha": "invalid",
             "manual_pdf_image": "invalid",
             "vegavisuals_sha": "invalid",
         }
@@ -1047,6 +1054,16 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         if marker not in ci_text:
             errors.append(f"ci.yml: missing required check {marker}")
     ci_docker = ci.get("jobs", {}).get("docker", {})
+    published_pdf_gate = _named_step(ci.get("jobs", {}).get("distribution", {}), "Test published PDF deployment provenance")
+    if published_pdf_gate != {
+        "name": "Test published PDF deployment provenance",
+        "env": {
+            "UNALTRAWEB_DEPLOY_PROVENANCE_DOCKER": "1",
+            "UNALTRAWEB_DEPLOY_PROVENANCE_SOURCE_SHA": "${{ github.event.pull_request.head.sha || github.sha }}",
+        },
+        "run": "PYTHONPATH=test python -m unittest test_deploy_provenance.PublishedDeployProvenanceTests",
+    }:
+        errors.append("ci.yml: published PDF deployment provenance must run unconditionally with real Docker")
     ruby_tests = str(_named_step(ci_docker, "Test all Ruby files").get("run") or "")
     if not all(
         marker in ruby_tests
@@ -1362,8 +1379,20 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         for marker in ["MANUAL_PDF_IMAGE", "WORKFLOW_REPOSITORY", "WORKFLOW_SHA", "docker pull", "docker image inspect", "org.opencontainers.image.revision"]:
             if marker not in provenance_text:
                 errors.append(f"site-deploy.yml: PDF worker provenance check missing {marker}")
-        if '[[ "$image_revision" != "$WORKFLOW_SHA" ]]' not in provenance_text:
-            errors.append("site-deploy.yml: PDF worker revision label must be compared with the defining workflow SHA")
+        if '[[ "$image_revision" != "$expected_pdf_revision" ]]' not in provenance_text:
+            errors.append("site-deploy.yml: PDF worker revision label must be compared with its recorded producer SHA")
+        provenance_sha256 = hashlib.sha256(
+            json.dumps(provenance_step, sort_keys=True, separators=(",", ":")).encode()
+        ).hexdigest()
+        if provenance_sha256 != DEPLOY_PDF_PROVENANCE_POLICY_SHA256:
+            errors.append("site-deploy.yml: PDF digest/producer gate differs from the exact reviewed structure")
+        try:
+            contract = json.loads((ROOT / "src/unaltraweb_mcp/component-contract.json").read_text())
+            records = contract["deployment_contract"]["manual_pdf_workers"]
+            if sum(row.get("reference") == integration["manual_pdf_image"] for row in records) != 1:
+                errors.append("site-deploy.yml: selected PDF worker has no reviewed digest/producer record")
+        except (OSError, ValueError, KeyError, TypeError):
+            errors.append("site-deploy.yml: missing or invalid provider deployment records")
         if "docker pull" in provenance_text and "docker image inspect" in provenance_text and provenance_text.index("docker pull") > provenance_text.index("docker image inspect"):
             errors.append("site-deploy.yml: PDF worker digest must be pulled before its revision label is inspected")
         if "${{ github.workflow_sha }}" in deploy_text or "${{ github.workflow_repository }}" in deploy_text:
@@ -1542,7 +1571,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
             action, separator, revision = uses.rpartition("@")
             if not separator or action != integration["site_deploy_workflow"] or not FULL_SHA.fullmatch(revision):
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow must use an immutable unaltraweb SHA")
-            elif revision != integration["core_sha"]:
+            elif revision != integration["site_deploy_workflow_sha"]:
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow SHA has not been reviewed")
             reusable_job = scaffold.get("jobs", {}).get(job_name, {})
             if reusable_job.get("needs") != "validate":

data/src/unaltraweb_mcp/component-contract.json

@@ -2,17 +2,43 @@
   "$schema": "component-contract.schema.json",
   "schema_version": 1,
   "release": {
-    "version": "0.7.0",
-    "tag": "v0.7.0"
+    "version": "0.7.1",
+    "tag": "v0.7.1"
   },
   "consumer_integration": {
     "schema_version": 1,
     "core_repository": "https://github.com/dosquartsdedocs/unaltraweb.git",
-    "core_sha": "216ab2e8b6b8b45a5bb7da0a54bffd10edee895d",
+    "core_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
     "site_deploy_workflow": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml",
-    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+    "site_deploy_workflow_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
+    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
     "vegavisuals_sha": "a448cc50a5f511743a6fcfc213baeb9be80f4a27"
   },
+  "deployment_contract": {
+    "schema_version": 1,
+    "manual_pdf_workers": [
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:9e0b3a45753c170b795e9a9d6df61580085c113436beac5bf6c8de69b6562097",
+        "producer_sha": "d857f8c9f5fea90cf450c0b30b4e77a37b541275"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+        "producer_sha": "5cf9817489c8dc47cee726bfe42fe3071cd32b85"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
+        "producer_sha": "b7ec1d7a139c65b3b0b88699cdbeb19080f13be1"
+      }
+    ],
+    "caller_migrations": [
+      {
+        "id": "deploy-provenance-86",
+        "path": ".github/workflows/deploy.yml",
+        "baseline_sha256": "a789870542614d5817d30ea4328c7d1ad38d27443c009c68a48ad5aaa3106b8e",
+        "current_sha256": "c632a548d0782867be20a2a52fe03469cf63066b7364bace77fd54a226cb3b18"
+      }
+    ]
+  },
   "receipt_contract": {
     "schema_version": 1,
     "path_template": ".unaltraweb/receipts/{provider}.json",
@@ -36,10 +62,10 @@
     "gem": {
       "kind": "gem",
       "name": "unaltraweb",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "unaltraweb (= 0.7.0)",
+      "reference": "unaltraweb (= 0.7.1)",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
       "features": ["jekyll-core", "site-build"]
@@ -47,10 +73,10 @@
     "wheel": {
       "kind": "python-wheel",
       "name": "unaltraweb-mcp",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "unaltraweb-mcp==0.7.0",
+      "reference": "unaltraweb-mcp==0.7.1",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": true,
       "features": ["calibre-import", "doctor", "new-web", "offline-inspection", "mcp-control-plane"]
@@ -58,10 +84,10 @@
     "runtime": {
       "kind": "container",
       "name": "unaltraweb runtime",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.7.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.7.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -70,10 +96,10 @@
     "mcp": {
       "kind": "container",
       "name": "unaltraweb MCP runtime",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-mcp",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -118,10 +144,10 @@
     "manual_pdf": {
       "kind": "container",
       "name": "unaltraweb manual PDF worker",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "released",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,

data/src/unaltraweb_mcp/component-contract.schema.json

@@ -7,7 +7,7 @@
   "required": ["schema_version", "release", "consumer_integration", "receipt_contract", "wheel_contract", "components"],
   "properties": {
     "$schema": {"type": "string"},
-    "schema_version": {"const": 1},
+    "schema_version": {"type": "integer", "const": 1},
     "release": {
       "type": "object",
       "additionalProperties": false,
@@ -22,14 +22,47 @@
       "additionalProperties": false,
       "required": ["schema_version", "core_repository", "core_sha", "site_deploy_workflow", "manual_pdf_image", "vegavisuals_sha"],
       "properties": {
-        "schema_version": {"const": 1},
+        "schema_version": {"type": "integer", "const": 1},
         "core_repository": {"const": "https://github.com/dosquartsdedocs/unaltraweb.git"},
         "core_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "site_deploy_workflow": {"const": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml"},
+        "site_deploy_workflow_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "manual_pdf_image": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
         "vegavisuals_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
       }
     },
+    "deployment_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "manual_pdf_workers", "caller_migrations"],
+      "properties": {
+        "schema_version": {"type": "integer", "const": 1},
+        "manual_pdf_workers": {
+          "type": "array", "minItems": 1, "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["reference", "producer_sha"],
+            "properties": {
+              "reference": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
+              "producer_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
+            }
+          }
+        },
+        "caller_migrations": {
+          "type": "array", "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["id", "path", "baseline_sha256", "current_sha256"],
+            "properties": {
+              "id": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"},
+              "path": {"const": ".github/workflows/deploy.yml"},
+              "baseline_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"},
+              "current_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"}
+            }
+          }
+        }
+      }
+    },
     "receipt_contract": {
       "type": "object",
       "additionalProperties": false,

data/src/unaltraweb_mcp/distribution.py

@@ -20,7 +20,15 @@ def _strict_json(path: Path) -> Any:
     def reject(value: str) -> None:
         raise ValueError(f"non-finite JSON number is not allowed: {value}")
 
-    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject)
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result:
+                raise ValueError(f"duplicate component contract key: {key}")
+            result[key] = value
+        return result
+
+    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject, object_pairs_hook=unique)
 
 
 def _schema_type_matches(value: Any, expected: str) -> bool:
@@ -155,6 +163,9 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     expected_workflow = f"{expected_core_repository.removeprefix('https://github.com/').removesuffix('.git')}/.github/workflows/site-deploy.yml"
     if integration["site_deploy_workflow"] != expected_workflow:
         errors.append("consumer integration deploy workflow must belong to the core provider")
+    workflow_sha = str(integration.get("site_deploy_workflow_sha", core_sha))
+    if re.fullmatch(r"[0-9a-f]{40}", workflow_sha) is None or workflow_sha == "0" * 40:
+        errors.append("consumer integration workflow SHA must be a nonzero full lowercase commit SHA")
     expected_pdf_prefix = f"{value['components']['manual_pdf']['image_repository']}@sha256:"
     manual_pdf_image = str(integration["manual_pdf_image"])
     if re.fullmatch(rf"{re.escape(expected_pdf_prefix)}[0-9a-f]{{64}}", manual_pdf_image) is None or manual_pdf_image.endswith("0" * 64):
@@ -162,6 +173,26 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     vegavisuals_sha = str(integration["vegavisuals_sha"])
     if re.fullmatch(r"[0-9a-f]{40}", vegavisuals_sha) is None or vegavisuals_sha == "0" * 40:
         errors.append("consumer integration Vega revision must be a nonzero full lowercase commit SHA")
+    deployment = value.get("deployment_contract")
+    if deployment is not None:
+        references = [row["reference"] for row in deployment["manual_pdf_workers"]]
+        if not 1 <= len(references) <= 64:
+            errors.append("deployment worker inventory must contain between 1 and 64 records")
+        if len(set(references)) != len(references):
+            errors.append("deployment worker references must be unique")
+        if manual_pdf_image not in references or value["components"]["manual_pdf"]["reference"] != manual_pdf_image:
+            errors.append("selected PDF worker must match a reviewed deployment record and the component reference")
+        for row in deployment["manual_pdf_workers"]:
+            if row["producer_sha"] == "0" * 40 or row["reference"].endswith("0" * 64):
+                errors.append("deployment worker identities must be nonzero")
+        migrations = deployment["caller_migrations"]
+        if len(migrations) > 32:
+            errors.append("deployment caller migration inventory exceeds 32 records")
+        if len({row["id"] for row in migrations}) != len(migrations) or len({(row["path"], row["baseline_sha256"], row["current_sha256"]) for row in migrations}) != len(migrations):
+            errors.append("deployment caller migrations must be unique")
+        for row in migrations:
+            if row["baseline_sha256"] == row["current_sha256"] or "0" * 64 in (row["baseline_sha256"], row["current_sha256"]):
+                errors.append("deployment caller migration requires distinct nonzero baseline and current hashes")
     return errors
 
 
@@ -194,7 +225,16 @@ def distribution_version() -> str:
 
 def consumer_integration() -> dict[str, Any]:
     """Return an isolated copy of the reviewed consumer runtime tuple."""
-    return dict(_contract()["consumer_integration"])
+    result = dict(_contract()["consumer_integration"])
+    result.setdefault("site_deploy_workflow_sha", result["core_sha"])
+    return result
+
+
+def deployment_contract() -> dict[str, Any]:
+    """Provider-owned identities and exact reviewed caller migrations."""
+    return json.loads(json.dumps(_contract().get("deployment_contract", {
+        "schema_version": 1, "manual_pdf_workers": [], "caller_migrations": [],
+    })))
 
 
 def component(component_id: str) -> dict[str, Any]:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unaltraweb
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - dosquartsdedocs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: classifier-reborn
@@ -801,10 +801,13 @@ files:
 - docs/agents/action-prompts/60-bibliometrics-refresh.txt
 - docs/agents/action-prompts/70-build-and-review.txt
 - docs/agents/d0-runtime-identity.md
+- docs/agents/deploy-provenance-86.md
+- docs/agents/deployment-integration-0.7.1.md
 - docs/agents/manual-authoring-components.md
 - docs/agents/mcp-contract.md
 - docs/agents/owner-closeout-76.md
 - docs/agents/owner-closeout-80.md
+- docs/agents/owner-closeout-85.md
 - docs/agents/owner-followup-76.md
 - docs/agents/owner-preparation-2026-09-29.md
 - docs/agents/quarto-computation-adoption.md