unaltraweb 0.7.0 → 0.7.2

data/docs/agents/owner-closeout-85.md

@@ -0,0 +1,269 @@
+# unaltraweb 0.7.0 D0 delivery closeout
+
+Published **2026-10-05 21:45:13 UTC**:
+[v0.7.0](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0).
+Owner: [issue 85](https://github.com/dosquartsdedocs/unaltraweb/issues/85).
+Coordination: [gaContExt 15](https://github.com/dosquartsdedocs/gacontext/issues/15).
+Requirements: gaContExt `5634ea2e3e42122bb365992dfca9f248feb89dec`.
+This report supersedes the chronological candidate state in the
+[native API contract](d0-runtime-identity.md).
+
+## Review and exact source
+
+The owner explicitly authorized the complete review/PR/integration, gated
+publication and separate post-release checkout pin. Work used only
+`/home/benizar/git/unaltraweb`, ordinary serial branches and synthetic consumers.
+Existing releases, authored state and unrelated client registrations were retained.
+
+| Role | Revision / evidence |
+| --- | --- |
+| Reviewed D0 implementation | `0c87e8c276e58ac9c747833df69cdb439aa6132b` |
+| Integrated core selected by consumers | `216ab2e8b6b8b45a5bb7da0a54bffd10edee895d`, [PR 87](https://github.com/dosquartsdedocs/unaltraweb/pull/87) |
+| Core selection commit | `2881a37dd6e5071d71c30cb44aa9af6faba5e886` |
+| Final artifact-producing source | `b44818c67eecef159f7aa0f825b0416cd511bc43`, [PR 88](https://github.com/dosquartsdedocs/unaltraweb/pull/88) |
+| Receipt-only child | `6dc13638c49bfb53a1c456e9e6b30aec7b3fd713` |
+| Receipt integration / tag target | `9fc84ac7fd01c78c6fe15fe862beb6a5d1633a9e`, [PR 89](https://github.com/dosquartsdedocs/unaltraweb/pull/89) |
+| Annotated tag object | `28a2a40b4b633be2fefb3f1c753cf95db1c7bdf6` |
+| Reviewed post-release pin / report | `7f9ce5b3bd844aed3a820c98f9712b7cfc8c23ea` |
+| Post-release integration | `833c5548ff01801097ddd56114d9039fd3914a43`, [PR 90](https://github.com/dosquartsdedocs/unaltraweb/pull/90) |
+
+Review records are explicitly agent-attributed, not human approval. The receipt
+integration's first parent is the artifact source; its first-parent diff contains
+only `release-candidates.json`. Native package authorization, exact staging,
+strict distribution/publication-ref checks and annotated-tag verification passed
+before privileged publication. These release checks apply to the receipt/tag
+revision, not later ordinary post-release commits.
+
+## Receipt, packages and images
+
+[Tagged receipt](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.7.0/release-candidates.json):
+schema 1, source `b44818c67eecef159f7aa0f825b0416cd511bc43`, SHA-256
+`92b4feafbf822ff5b0d9fc6534f963e68c2a28a875d4e2e841c051e7c619e7dc`.
+It contains exactly the four components marked `ready` in the source BOM.
+
+| Component | Artifact / repository | SHA-256 / OCI index digest |
+| --- | --- | --- |
+| Gem | `unaltraweb-0.7.0.gem` | `1f4c71fc03bc3025018873eae73f7a2274e46b87ac678805e4150b8351b9ff0c` |
+| Wheel | `unaltraweb_mcp-0.7.0-py3-none-any.whl` | `3c9cd477e8c2fa0f69c1309c9302b110b73032600e8cf040c4818169863dd868` |
+| Base runtime | `ghcr.io/dosquartsdedocs/unaltraweb` | `sha256:ce67aa8fb90899e3c770c4ec8952b760cc8cafb3ed203e8e15266a9623bb3d31` |
+| MCP | `ghcr.io/dosquartsdedocs/unaltraweb-mcp` | `sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677` |
+
+Both OCI aliases `0.7.0` and `v0.7.0` were inspected anonymously and match these
+digests. Local Linux/amd64 configuration IDs are distinct:
+
+- Runtime: `sha256:beec5459bc7aa159af428fbad5d14a4527f3143e5062ec305a00619c31aae706`.
+- MCP: `sha256:b03e463343abcd0d5891f68ec423256f970d7c1fb35dc875e089e0f745cfe39a`.
+
+Their revision labels equal the artifact source. The image workflow verified
+GitHub-signed provenance, signer workflow, source revision and labels before
+executing the exact candidates. Semver promotion reverified those identities and
+reused the tested manifests without rebuilding.
+
+The package workflow artifact is `11329540867`, named
+`unaltraweb-0.7.0-b44818c67eecef159f7aa0f825b0416cd511bc43`; its archive digest is
+`sha256:9af51fb8447cf77691ffd362a752b247a9a1ee45a351f44b8de8ac60d62317c9`.
+The publisher authorized the exact successful run, source and inventory, then
+verified/staged the recorded hashes. Separate OIDC jobs published those bytes.
+Anonymous PyPI/RubyGems metadata and downloads match them. Downloaded GitHub
+Release assets also pass `SHA256SUMS`, whose SHA-256 is
+`4abdefd44dd6cce44262fd19e224a54ca7a1d1b7ada66071d5b737d94f9270ab`.
+
+## Reused workers and accepted helpers
+
+The selected PDF remains the published, signed 0.6.0 specialization:
+`ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed`.
+Its configuration ID is
+`sha256:d7e7d3243616270fc9e6eed7f8238c412dbe3d9ffc18d2832d17d66ca630d139`.
+It is `released`, outside the four-component receipt. The source-bound workflow
+also tested PDF candidate
+`sha256:d6d866cd16eab156e7dc3fea2fd7e649d8b91dca2916b45cd5c2218184d5928b`;
+that verification-only candidate received no 0.7.0 semver promotion and is not
+the selected worker.
+
+Computation and capture keep their 0.4.0 immutable BOM references. The retained D0
+observation reports Python compute as prepared; R compute and web capture were
+locally missing and remained explicitly `missing`, without fallback. This
+acceptance executes web/manual-PDF work, not every optional computation/capture
+workflow. An adapter enabling those features must prepare and verify their exact
+workers separately.
+
+| Accepted helper | Wheel SHA-256 | Renderer configuration ID |
+| --- | --- | --- |
+| Diavisuals 0.5.0 | `f52e20f20f1fb3a2418f07adb8d6a68a5567d0c321fb7c0ccc0f4db04917b96b` | `sha256:5a6887b372a0e1c386a7b54981d11ae1910215baeb6a12dfd0706b3e85ef0846` |
+| Vega 0.5.1 | `5aba4f267a37179c520b3cd164e1cec62ac5561872aa33b069cce73442dc52b1` | `sha256:695125943d0fbc3aa7c877babb9a11a6501bbc7ac265b0975bb5657c60439d98` |
+
+Native selection uses Diavisuals `--runtime-image` / `--runtime-expected-id` and
+Vega `--renderer-image-id`. Actual Mermaid, PlantUML, Vega-Lite/CSV and Vega renders
+passed receipt verification, tamper refusal and consumer relocation. Existing
+renderer aliases were unchanged. Exact 0.4.0 static receipt compatibility retains
+all input/output/request integrity checks; no continuous version range is inferred.
+
+## Live identity and installed acceptance
+
+The actual serving process provides `runtime_identity` and
+`web://runtime-identity`; both agreed on the backend instance. Native profile
+`unaltraweb-docker-stdio-v1` uses one connection per backend, one operation at a
+time, explicit drain and scoped orphan recovery. Host commands `session-status`
+and `reap-session` consume the retained consumer/session/container tuple.
+
+The initial accepted backend instance was `400244b6784c46498aadd3ec3b9c088f`, with
+inner PID 7 in `pid:[4026533734]`, start ticks `65541450`, Python 3.13.5 and
+executable `/usr/bin/python3`. Container
+`3feb725c68984e69fe208d56bdf06ec2dfcff4d43f1071045ebc0eadf3779ffe` had daemon init
+PID `3938960`; these PIDs belong to different namespaces. The canonical consumer
+binding was `/tmp/opencode/unaltraweb-d0-85/candidate-d0-proof/consumer A`.
+Reconnection produced instance `9c9d94e47c324be89abff5e80defb024` while the second
+consumer retained instance `413e89f4ebd34e5d8570b1db6a8360af`.
+
+The installed engine root was `/usr/local/lib/python3.13/dist-packages/unaltraweb_mcp`.
+Loaded version 0.7.0 and startup code fingerprint
+`5fdfb154f82d01bb5dcc5a35d74ba2f384b36e60a5111b63831b6216adfb8996` remained fixed
+when metadata in the disposable container overlay changed to 99.0.0. Current
+bytes reported drift; the prepared image was unchanged. Observed canonical
+component-contract hash:
+`d2cddda50780f00ec3af47826a93341e014d4811146195ed09a9bf1ee5fcdf81`;
+profile hash:
+`6c9305143f2f5e3dee831f3d5bf2b5413e51f24e3f28310fa21019c645532481`.
+Selection hashes additionally bind each consumer/worker tuple and are retained in
+the evidence. These observations are not permanent process attestations.
+
+`test/d0_runtime_smoke.py` passed all eight stages against the downloaded CI wheel
+and signed MCP: reconnect/scope, loaded-versus-disk, busy drain, backend-crash
+recovery, offline launch, explicit nested daemon mapping, wrong worker and missing
+worker. Wrong/missing controller images were also refused. A real PDF job was
+observed **busy after backend death**; recovery waited until it became eligible,
+then proved resource absence while another live backend remained connected.
+EOF/drain released only the retired session's resources.
+
+The real 0.6.0 → 0.7.0 → 0.6.0 roundtrip preserved authored files and old generated
+cache entries. The unrelated registration sentinel retained SHA-256
+`2705c6065bbc5665798be533b1057070b6efeae289cab3e800579cb6b5608afb`.
+The historical 0.6.0 process lacks live identity and remains an explicitly
+**partial** point, not a second D0-capable release.
+
+## Retained Carta and populated Bundler regressions
+
+`test/artifact_import_smoke.py` consumed the authenticated published Carta packet.
+Bundle hash `aeaa757ee1be19bfe56dc9af8dd1178032929b4a2bec2dad2ebb621b158ad999`
+and the 12-file seal remain intact. The mapping from `payload/output/letter.pdf`
+to `assets/documents/carta.pdf` retains original PDF hash
+`4a661740a18fe1cf75b84aa0d8532511fd105eb5484a5af700e11e8e30828ea4`.
+Integration record hash:
+`995e213e9c5677763809b4d108b84882e1821be58796e0823b8260c22f891a18`.
+
+The copied producer and incoming tree were removed, author prose survived
+reimport, and the receiver moved before native/generic checking and a forced PDF
+rebuild. Web/HTTP passed at both locations. Both 11-page PDFs have SHA-256
+`026552039659771d73a26875dc628c5dbccb8da2d4c32bcf0a199929efdd60e2`; the unchanged
+letter appears on page 10. Generic verification confirmed one bundle, one mapping
+and 14 files; the native checker also bound the chapter and rendered page.
+
+`test/bundler_transition_smoke.py` passed all four profiles using actual immutable
+0.4.0, unpatched 0.5.0 and new 0.7.0 MCP references. The known failure was
+reproduced on a separate copy. Each 0.7.0 activation and return to 0.4.0 passed
+two builds and a preview. All six author/cache files kept their hashes, with no
+cache clearing. `test/published_companion_smoke.py` passed with the published
+helper wheels and explicit renderer IDs above. The downloaded CI gem passed
+`scripts/test_gem_build.py:inspect_gem`, including isolated native helper closure.
+
+## CI and retained evidence
+
+| Gate | Successful run |
+| --- | --- |
+| Implementation PR CI / CodeQL | [37271200816](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37271200816) / [37271200817](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37271200817) |
+| Core selection PR CI / CodeQL | [37272201763](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272201763) / [37272201726](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272201726) |
+| Final artifact source CI / CodeQL | [37272717370](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272717370) / [37272717381](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37272717381) |
+| Signed candidate image build/test | [37273192732](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37273192732) |
+| Package preparation | [37273195884](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37273195884) |
+| Receipt PR CI / CodeQL | [37371882737](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37371882737) / [37371882776](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37371882776) |
+| Receipt integration CI / CodeQL | [37375549493](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37375549493) / [37375549627](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37375549627) |
+| Tag CI | [37376786630](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37376786630) |
+| Semver image promotion | [37377435437](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37377435437) |
+| PyPI/RubyGems Trusted Publishing | [37377438226](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37377438226) |
+| Post-release PR CI / CodeQL | [37379728022](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37379728022) / [37379728286](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37379728286) |
+| Post-release integration CI / CodeQL | [37380436187](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37380436187) / [37380436184](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37380436184) |
+
+Two first-attempt receipt PR jobs were not acquired by hosted runners and ran no
+steps. Their retry passed without source changes; original attempts remain in
+the local evidence. The local source suite passed 608 Python cases, with 30
+optional/environment skips. No failed job was bypassed for merge or publication.
+
+Evidence root: `/tmp/opencode/unaltraweb-d0-85/`.
+
+| Retained result | SHA-256 |
+| --- | --- |
+| `image-evidence/tested-images.json` | `6c38a1d08511d0cb6554905bc236de58a9f594b255553361d36e6caa4622335d` |
+| `candidate-d0-proof/evidence.json` | `e8140ef8cf47e4329f7691b8a3733377a17269b83c2cf2e9b444c94ce22621f6` |
+| `candidate-carta-proof/evidence.json` | `c1b12f80b1a3c0d31a83fa015f050f0897923ef578ecac9c20f95e4acaa6fca0` |
+| `candidate-bundler-proof/evidence.json` | `8206e1a9e4a88123390dad30ba314d0b2fa00820a5af426164f060050be3ab4d` |
+| `candidate-helpers-proof/evidence.json` | `df994ccd8afaff45a7e3cfa9b6a29b650c9d01d63db2c9c36e59c31834273473` |
+| `published-packages/verified.json` | `e892bbb22c35ea3eef3b2abbbd6351e4a290e76d322c91ac3de6fb212965909f` |
+| `public-images.json` | `f123c2dc096405bde004cfd6cbce206a0f56925f436731e575830cf111d26314` |
+| `post-pin-proof/evidence.json` | `0944b95eec8d0e1103f4895595c77780d27ebc1a3e64626f421b960be8efd144` |
+
+## Public installation and checkout selection
+
+A fresh public-wheel venv passed default `prepare`, `check` and real stdio
+`smoke`, with the expected MCP configuration ID. That public installation also
+rechecked the relocated Carta source/rendered mapping. The public gem installed
+in an isolated gem home and activated as 0.7.0 with the runtime's existing Ruby
+dependencies, including Ruby's default gem paths; this is not a network-fresh
+dependency installation claim.
+
+The separate `chore/85-pin-published-mcp-0.7.0` source change selects the published
+digest in Make/bootstrap and updates its existing pin regression and current docs.
+It does not alter the published BOM, receipt, tag or artifact bytes. PR 90 and its
+integration passed protected CI; the resulting main checkout was clean and
+synchronized. The later helper-intake clarification is documentation-only.
+
+The actual `MCP_CONSUMER_WORKSPACE=… make mcp-stdio` transport started a synthetic
+consumer with live instance `2ebdbd20c32649c48bf309dc469f2c8b`. Tool/resource
+identity agreed, loaded 0.7.0 and the published image matched, and drain/close
+followed by exact retained-tuple inspection confirmed resource release.
+`make mcp-build` and the bootstrap's `--check` selected that public image directly.
+
+Post-pin local checks passed 608 Python cases (579 passed, 29 optional skips),
+`make distribution-check workflow-check`, the fresh `make wheel-check`, prose
+checks, `editorial-publication-check` and `git diff --check`. The prose checker
+reported only existing informational sentence-length cues, not blocking findings.
+The source Make targets were exercised with independently owned development names:
+
+```bash
+make mcp-check mcp-smoke \
+  MCP_RUNTIME_IMAGE=unaltraweb-d0-85-runtime:post-pin \
+  MCP_IMAGE=unaltraweb-d0-85-mcp:post-pin \
+  MANUAL_PDF_DEV_IMAGE=unaltraweb-d0-85-pdf:post-pin \
+  MCP_SMOKE_MANUAL_PDF_IMAGE=ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed
+make docs-build \
+  DOCKER_IMAGE=ghcr.io/dosquartsdedocs/unaltraweb@sha256:ce67aa8fb90899e3c770c4ec8952b760cc8cafb3ed203e8e15266a9623bb3d31
+```
+
+Both commands passed. Development outputs remain separate from the signed
+artifact acceptance and did not replace public semver images or retained caches.
+
+## Remaining gates and scope
+
+**The complete coordinator dependency graph is not declared managed-ready.**
+Selected Diavisuals 0.5.0 lacks full serving-process identity. The
+[provider return in Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14#issuecomment-5987114002)
+records that **Diavisuals 0.6.0 already published the native correction on
+2026-10-05 at 02:25:02 UTC**, from `1c2dd8c8138e27bcdb1b0fee1fd51e1d057130e3`.
+Its live mapping is `server_identity` / `diavisuals://server/identity`, with its
+own lifecycle. The open issue tracks acceptance/intake, not missing publication.
+
+Unaltraweb 0.7.0 was tested and published with 0.5.0. The outstanding composition
+gate is therefore **owner acceptance of the corrected helper and a new reviewed
+selection**, not another claim that the provider correction has yet to ship.
+The hub cannot widen the published 0.7.0 helper pin from metadata alone. It must
+also observe each independent helper process, prepare feature-specific workers
+and accept the native adapter before activation. This clarification does not
+change the released BOM or count Diavisuals 0.6.0 as tested Web compatibility.
+
+The acceptance platform is Linux/amd64 and the claimed backend profile is Docker
+stdio, one connection per instance. Shared HTTP backend reattachment and a fully
+D0-capable two-release roundtrip are not claimed. Arbitrary direct controller
+layouts remain [issue 31](https://github.com/dosquartsdedocs/unaltraweb/issues/31);
+only canonical host and explicitly mapped nested launchers were proved. Retained
+Carta coverage is the published English one-page leaf, not Diapora composition.
+Real manuals, author artifacts and existing client registrations were not migrated.
+Already-running clients retain their loaded runtime until explicit reconnection.

data/docs/agents/owner-closeout-93.md

@@ -0,0 +1,185 @@
+# unaltraweb 0.7.1 delivery closeout
+
+Published **2026-10-07 12:33:20 UTC**:
+[v0.7.1](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.1).
+Owner: [issue 93](https://github.com/dosquartsdedocs/unaltraweb/issues/93).
+This report supersedes the chronological preparation states in
+[deployment-integration-0.7.1.md](deployment-integration-0.7.1.md).
+
+## Delivered behavior
+
+The package owns independent immutable core/workflow pins and exact PDF
+digest/producer records. The reusable workflow fetches bounded strict JSON from
+its own defining provider revision, not the consumer checkout. Release readiness
+checks that selected workflow and its records. CI generates a caller, executes
+its actual selected provenance gates and compares retained-document verifier
+bytes across the selected core, controller and PDF worker.
+
+The exact issue-86 hotfix is recognized by the original baseline hash and current
+file hash, listed in the update plan and bound to its SHA. Extra local edits
+remain conflicts; existing confinement, staging, CAS and rollback are retained.
+The new/upgrade/hotfix installed acceptance preserves author and generated-cache
+hashes while building and probing actual web/PDF output.
+
+The owner explicitly authorized the full 0.7.1 review, integration, gated
+publication and post-release pin. Work used one authoritative checkout and serial
+ordinary branches. Reviews are agent-attributed, not human approval. Published
+earlier artifacts and real consumer selections remain intact.
+
+## Source and receipt lineage
+
+| Role | Revision / evidence |
+| --- | --- |
+| Implementation | `2133b8fa2f668e14d603a36d15584eed63e4386a`, [PR 94](https://github.com/dosquartsdedocs/unaltraweb/pull/94) |
+| Initial implementation integration | `2ff27f27c274eb09b2c53ef8bd374f333702d8ee` |
+| Initial candidate source, later rejected as a core tuple | `b7ec1d7a139c65b3b0b88699cdbeb19080f13be1`, [PR 95](https://github.com/dosquartsdedocs/unaltraweb/pull/95) |
+| Worker-record/checker-closure correction | `1ce0e2039e3cb59ed57dbef7961193c7de9ea751`, [PR 96](https://github.com/dosquartsdedocs/unaltraweb/pull/96) |
+| Selected reviewed core and workflow | `3332e0b93933f12317e05f1ce8d38ce80046feab` |
+| Final tuple selection | `18d8d20ba92e397b8341f91207ae05cb6146473b`, [PR 97](https://github.com/dosquartsdedocs/unaltraweb/pull/97) |
+| Final artifact-producing source | `ae5dab1d99804e7f73da82930199c1e2f3c08f61` |
+| Receipt-only child | `24834dcc3e2e03f0bb76b5f18c2fbe346b143455` |
+| Receipt integration / tag target | `1ff25c6956458c3a99436312466e9cc588ed34b9`, [PR 99](https://github.com/dosquartsdedocs/unaltraweb/pull/99) |
+| Annotated tag object | `6e8d7f107a6bfa013a400db0e2a3cb6269d37e38` |
+
+The tag target's first parent is exactly the final artifact source; its
+first-parent diff contains only `release-candidates.json`. Native package-run
+authorization/staging, strict distribution/ancestry/publication-ref checks and
+annotated-tag verification passed before publication.
+
+[Tagged receipt](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.7.1/release-candidates.json)
+SHA-256: `feda4f19b4133e60b4dae3cf88367ae8089c88077b4ac3fcfccc76d153411f2e`.
+
+| Component | Artifact / repository | SHA-256 / OCI index digest |
+| --- | --- | --- |
+| Gem | `unaltraweb-0.7.1.gem` | `6371e502601f970bc30711868b0eb2a29f429e1b78e21ac71ac09696b108baee` |
+| Wheel | `unaltraweb_mcp-0.7.1-py3-none-any.whl` | `cd2a06a2d2e16758c916d640e71210b16285fe3848cc987651801ff324a50a8e` |
+| Base runtime | `ghcr.io/dosquartsdedocs/unaltraweb` | `sha256:af776cfcd79f2778d36e179dccba63792d820d1939fd89187b7af7089e11247a` |
+| MCP | `ghcr.io/dosquartsdedocs/unaltraweb-mcp` | `sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6` |
+
+Linux/amd64 configuration IDs, distinct from registry index digests:
+
+- Runtime: `sha256:7b58b0ad1e7fdfd00087b6702c7002b4a4d393072077def17ff5fb1e198c8cfb`.
+- MCP: `sha256:f0e7915527fa68a67448287e131ec431aeae902b8269856e4e219e67faade146`.
+
+Both revision labels identify the final artifact source. Both `0.7.1` and
+`v0.7.1` aliases were inspected anonymously and match the receipt. Public registry
+downloads and downloaded GitHub assets match their hashes. `SHA256SUMS` itself
+has SHA-256 `10938774ef08dabd24cbd7853abd2d72957e75c750418ac8ebe7af7c1ce4553b`.
+
+## The PDF compatibility failure was caught before release
+
+The first core candidates reused PDF 0.6.0. Plain manuals passed, but retained
+Carta freshness failed because the verifier closure includes the changed
+`distribution.py` and component schema. The old worker's successful PDF output
+was not accepted as fresh by the new controller. No manifest was edited and no
+freshness check was disabled to force a pass.
+
+The signed specialization from the initial image run has the correct 0.7.1
+checker bytes and is now selected by immutable digest:
+
+```text
+ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
+producer: b7ec1d7a139c65b3b0b88699cdbeb19080f13be1
+configuration ID: sha256:618163d3f924439792b2306617bd9612f566c5881166102fa544b4e782d569fa
+native package version: 0.7.1
+```
+
+The final four-component receipt reuses this separately verified digest. The
+later image workflow also built verification PDF
+`sha256:6bc7342a9ad6eb4edfff0d022d7157370e9c9bcba2b87bb80532389cfded62d4`;
+it is not the selected worker and received no coordinated semver promotion.
+The rejected initial core candidate tuple and local diagnostic overlay remain
+clearly separated from final signed-byte acceptance.
+
+## CI, signing and publication
+
+| Gate | Successful run |
+| --- | --- |
+| Implementation PR CI / CodeQL | [37526811887](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37526811887) / [37526811747](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37526811747) |
+| Initial signed images / packages | [37530306398](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37530306398) / [37530310332](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37530310332) |
+| Worker-record PR CI / CodeQL | [37534571592](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37534571592) / [37534571578](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37534571578) |
+| Corrected tuple PR CI / CodeQL | [37613153175](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37613153175) / [37613153240](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37613153240) |
+| Final source CI / CodeQL | [37613808731](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37613808731) / [37613808758](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37613808758) |
+| Final signed images / packages | [37614367552](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37614367552) / [37614371507](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37614371507) |
+| Receipt PR CI / CodeQL | [37619948216](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37619948216) / [37619948348](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37619948348) |
+| Receipt integration CI / CodeQL | [37620746600](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37620746600) / [37620746542](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37620746542) |
+| Tag CI | [37620758376](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37620758376) |
+| Image promotion | [37621482487](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37621482487) |
+| PyPI/RubyGems Trusted Publishing | [37621486444](https://github.com/dosquartsdedocs/unaltraweb/actions/runs/37621486444) |
+
+Final package artifact `11479132691` has archive digest
+`sha256:648e84e49abc0af299f7caf1b1d50931da42439d0a58ceb0839ebfa99524893b`.
+The signing/test/promotion jobs verified exact digest, source and signer bindings.
+The package publisher authorized the run/source/inventory and published only the
+staged recorded bytes. Promotion reused the tested image manifests.
+
+## Installed final-byte proofs
+
+The final downloaded wheel and exact signed MCP, without a derived controller,
+passed all of these gates:
+
+- `deployment_integration_smoke.py`: new manual, populated 0.5.0 upgrade and exact
+  reviewed hotfix. Author/cache hashes were preserved, plans applied, PDF/web/HTTP
+  passed and the actual generated workflow pin was exercised.
+- `artifact_import_smoke.py`: authenticated Carta seal, original PDF, author prose,
+  copied-producer retirement, receiver relocation and forced rebuild. Both composed
+  PDFs have 11 pages and hash `1b942d003847126cfdbc14630059bb6ede5512751400b3701dab85a7d37b78a7`;
+  the unchanged original letter is on page 10. Integration record hash:
+  `e80d504b19677ace36c512f758161d3d5663d38d0979ef8c36bc87be765f9e40`.
+- `d0_runtime_smoke.py`: live identity, reconnect/scope, disk drift, busy drain,
+  real worker crash recovery, offline/mapping/mismatch checks and actual
+  0.7.0 → 0.7.1 → 0.7.0 rollback with retained state.
+- `bundler_transition_smoke.py`: all four populated 0.4.0 → 0.7.1 → 0.4.0 profiles,
+  two builds and a preview per point, unchanged author/cache files and separate
+  reproduction of the known unpatched 0.5.0 failure.
+- Published Diavisuals 0.5.0 / Vega 0.5.1 rendering, receipts, tampering and relocation;
+  downloaded-gem isolated helper closure. Earlier exact 0.4.0 static receipts retain
+  their integrity-checked compatibility point.
+
+Evidence root: `/tmp/opencode/unaltraweb-071-93/`.
+
+| Result | SHA-256 |
+| --- | --- |
+| `final-integration/evidence.json` | `dcfce02ed10e7567a1030c1c93fc31fb7d75dfc73281fe8f1c4ee6b46038b6da` |
+| `final-carta/evidence.json` | `c456b5e72d72bc224a7416589805c7d80c50d7fafe8747c86cd31ecb782cd308` |
+| `final-d0/evidence.json` | `989603ed0a09fd6af9ca659ffbb824ab46907cb4538d094dcf32e34c8ea77c25` |
+| `final-bundler/evidence.json` | `352fe35a81f36b2b44fbfe92f000d9179053d45f572b37f48485c82dd4c7c949` |
+| `final-helpers/evidence.json` | `df994ccd8afaff45a7e3cfa9b6a29b650c9d01d63db2c9c36e59c31834273473` |
+| `published-packages/verified.json` | `39b322784e5eef0ccde89ad8883e495c66ec9df23213fbe3301fb91862cb2c2c` |
+| `public-images.json` | `6c2f54a877728dabbf39f2f2b0432beb5fe4c50c98769b22e06b6e1c562d7f77` |
+| `post-pin-proof/evidence.json` | `f9168183e859e842b4bc236cca126edc2e9bd5464eb2527450302cc9342121c6` |
+
+A fresh public-wheel venv passed default prepare/check/stdio smoke with the exact
+expected configuration ID and rechecked the relocated Carta mapping. The public
+gem installed in an isolated gem home and activated as 0.7.1 using the runtime's
+existing dependency set; this is not a network-fresh dependency installation claim.
+
+The actual checkout `MCP_CONSUMER_WORKSPACE=… make mcp-stdio` transport reported
+instance `effcd7bce6cb477da6c49107a5582e02`, loaded 0.7.1 and the expected image.
+Tool/resource identity agreed, the scaffold target selected the reviewed workflow,
+and drain/close followed by exact session inspection proved resource release.
+The post-release pin/report PR and clean-main CI result are recorded in issue 93.
+
+The post-pin local suite passed 629 cases (599 passed, 30 optional skips),
+distribution/workflow/fresh-wheel gates, prose/publication-copy checks and
+whitespace checks. `make mcp-check mcp-smoke` used owned
+`unaltraweb-071-93-*:post-pin` development images and the selected public PDF;
+`make docs-build` used the exact published runtime digest. Both passed. These
+development builds are separate from the signed-byte acceptance above.
+
+## Consumer and hub boundaries
+
+TIG independently adopted the earlier issue-86 hotfix in
+[geourv/tig#24](https://github.com/geourv/tig/pull/24) and deployed reviewed main
+`f5ddfabe650c95c10a99f3656a7cfc09e885dcbf` in successful run
+[37523692990](https://github.com/geourv/tig/actions/runs/37523692990).
+Its owner verified the public 311-page PDF byte-for-byte against the approved
+copy, SHA-256 `3d58d63b7315099ac3518401415c35f0a0acf4a3f7f41ee6270716f394309bc4`.
+That is hosted proof of its existing 0.5.0/hotfix combination, not a 0.7.1 migration.
+
+This release's acceptance covers Linux/amd64 installed web/PDF work and selected
+workflow preflights; real-manual hosted adoption remains per-consumer. The full
+managed helper graph still needs composing-owner acceptance of the published
+Diavisuals 0.6.0 correction; selected rendering compatibility remains 0.5.0.
+gaContExt catalogue/advisory/activation work and deliberate client reconnection
+remain separate. Earlier releases, author data and client registrations are preserved.