unaltraweb 0.7.0 → 0.7.2

data/scripts/test_wheel_install.py

@@ -103,6 +103,10 @@ def main() -> int:
             "unaltraweb_mcp/editorial_sources.py",
             "unaltraweb_mcp/image_backgrounds.py",
             "unaltraweb_mcp/image_probe.py",
+            "unaltraweb_mcp/source_checks.py",
+            "unaltraweb_mcp/source-check-policy-v1.schema.json",
+            "unaltraweb_mcp/practice_verifier.py",
+            "unaltraweb_mcp/practice-verifier-runtime.json",
             "unaltraweb_mcp/scaffolds/common/AGENTS.md.tmpl",
             "unaltraweb_mcp/scaffolds/common/Makefile.tmpl",
             "unaltraweb_mcp/scaffolds/common/README.md.tmpl",
@@ -117,6 +121,7 @@ def main() -> int:
             "unaltraweb_mcp/scaffolds/common/.github/dependabot.yml.tmpl",
             "unaltraweb_mcp/scaffolds/common/.github/pull_request_template.md",
             "unaltraweb_mcp/scaffolds/common/.github/workflows/deploy.yml.tmpl",
+            "unaltraweb_mcp/scaffolds/common/.github/workflows/source-checks.yml.tmpl",
         ]
         missing = [name for name in required if name not in names]
         if missing:
@@ -129,6 +134,10 @@ def main() -> int:
         python = environment / "bin/python"
         cli = environment / "bin/unaltraweb-mcp"
         run([str(python), "-m", "pip", "install", "--no-deps", str(wheels[0])], cwd=temp, env=env)
+        source_cli = environment / "bin/unaltraweb-source-checks"
+        source_help = run([str(source_cli), "--help"], cwd=temp).stdout
+        if "--base-sha" not in source_help or "--reports" not in source_help:
+            raise RuntimeError("Installed source-CI entrypoint is missing its bounded interface")
         docker_cli = environment / "bin/unaltraweb-mcp-docker"
         launcher = Path(run([str(docker_cli), "path"], cwd=temp).stdout.strip())
         if launcher != environment / "share/unaltraweb-launcher":
@@ -178,6 +187,11 @@ def main() -> int:
             ], cwd=temp).stdout)
             if not created["ok"]:
                 raise RuntimeError(f"new-web failed for {profile} from clean wheel: {created}")
+            source_policy = json.loads((profile_site / ".unaltraweb/source-checks.json").read_bytes())
+            if source_policy["profile"] != profile:
+                raise RuntimeError("Source-CI policy did not declare the generated profile")
+            if not (profile_site / ".github/workflows/source-checks.yml").is_file():
+                raise RuntimeError("Source-CI workflow control is missing")
             readme = (profile_site / "README.md").read_text(encoding="utf-8")
             agents = (profile_site / "AGENTS.md").read_text(encoding="utf-8")
             collaboration = (profile_site / ".github/CONTRIBUTING.md").read_text(encoding="utf-8")
@@ -290,7 +304,7 @@ def main() -> int:
                 raise RuntimeError(f"generated {profile} Gemfile does not use the reviewed core revision")
             if f'revision: {integration["core_sha"]}' not in lockfile:
                 raise RuntimeError(f"generated {profile} lockfile does not use the reviewed core revision")
-            if f'uses: {integration["site_deploy_workflow"]}@{integration["core_sha"]}' not in deploy:
+            if f'uses: {integration["site_deploy_workflow"]}@{integration["site_deploy_workflow_sha"]}' not in deploy:
                 raise RuntimeError(f"generated {profile} deploy caller does not use the reviewed core revision")
             if f'manual-pdf-image: "{integration["manual_pdf_image"]}"' not in deploy:
                 raise RuntimeError(f"generated {profile} deploy caller does not use the reviewed PDF image")
@@ -317,6 +331,7 @@ def main() -> int:
                 "Gemfile.lock",
                 ".github/pull_request_template.md",
                 ".github/workflows/deploy.yml",
+                ".github/workflows/source-checks.yml",
             }
             if set(manifest["files"]) != expected_managed:
                 raise RuntimeError(f"generated {profile} scaffold baseline is incomplete: {manifest['files']}")

data/scripts/unaltraweb-mcp-bootstrap.sh

@@ -15,7 +15,7 @@ Managed mode requires an immutable reference or an expected full image ID.
 USAGE
 }
 
-image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05}"
+image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6}"
 project="${MCP_CONSUMER_WORKSPACE:-${UNALTRAWEB_PROJECT:-}}"
 operation=serve
 expected_image="${UNALTRAWEB_EXPECTED_IMAGE_ID:-}"

data/scripts/validate_distribution.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import os
 import re
@@ -39,7 +40,8 @@ from unaltraweb_mcp.distribution import (  # noqa: E402
     is_mutable_reference,
     validate_component_contract,
 )
-from scripts.validate_workflows import load_workflow_text, reusable_deploy_input_errors  # noqa: E402
+from scripts.validate_workflows import DEPLOY_PDF_PROVENANCE_POLICY_SHA256, load_workflow_text, reusable_deploy_input_errors  # noqa: E402
+from scripts import check_practice_verifier_runtime as practice_verifier  # noqa: E402
 
 
 def load_yaml(path: Path) -> dict[str, Any]:
@@ -88,6 +90,21 @@ def component_version_errors(contract: dict[str, Any]) -> list[str]:
     return errors
 
 
+def selected_deployment_errors(contract: dict[str, Any], workflow: dict[str, Any], provider_contract: dict[str, Any]) -> list[str]:
+    """Release readiness binds the called workflow's code and data, not local YAML."""
+    errors = []
+    steps = workflow.get("jobs", {}).get("build", {}).get("steps", [])
+    step = next((row for row in steps if row.get("name") == "Verify manual PDF image provenance"), {})
+    if hashlib.sha256(json.dumps(step, sort_keys=True, separators=(",", ":")).encode()).hexdigest() != DEPLOY_PDF_PROVENANCE_POLICY_SHA256:
+        errors.append("selected deployment workflow does not contain the reviewed contract-driven provenance gate")
+    reference = contract["consumer_integration"]["manual_pdf_image"]
+    expected = [row for row in contract.get("deployment_contract", {}).get("manual_pdf_workers", []) if row.get("reference") == reference]
+    actual = [row for row in provider_contract.get("deployment_contract", {}).get("manual_pdf_workers", []) if row.get("reference") == reference]
+    if len(expected) != 1 or actual != expected:
+        errors.append("selected deployment workflow's producer record differs from the package's PDF identity")
+    return errors
+
+
 def validate(root: Path = ROOT) -> list[str]:
     errors: list[str] = []
     contract = distribution_contract()
@@ -95,6 +112,9 @@ def validate(root: Path = ROOT) -> list[str]:
     required_components = {
         "gem", "wheel", "runtime", "mcp", "compute_python", "compute_r", "web_capture", "manual_pdf", "diavisuals", "vegavisuals"
     }
+    if practice_verifier.COMPONENT in contract.get("components", {}):
+        required_components.add(practice_verifier.COMPONENT)
+        errors.extend(practice_verifier.publication_errors(contract))
     if contract.get("schema_version") != 1:
         errors.append("component contract schema_version must be 1")
     if set(contract.get("components", {})) != required_components:
@@ -105,6 +125,10 @@ def validate(root: Path = ROOT) -> list[str]:
     if __version__ != version:
         errors.append(f"wheel version {__version__} != contract version {version}")
     errors.extend(component_version_errors(contract))
+    if practice_verifier.required(contract):
+        dockerfile = (root / "Dockerfile.mcp").read_text()
+        if "install_practice_verifier" in dockerfile or re.search(r"(?im)^\s*(?:RUN|COPY|ADD).*unaltracaptura", dockerfile):
+            errors.append("Public MCP image must not download or embed the private QGIS package")
     included = {name for name, item in contract["components"].items() if item["included_in_wheel"]}
     if included != {"wheel"}:
         errors.append(f"wheel must not bundle external components: {sorted(included)}")
@@ -125,6 +149,11 @@ def validate(root: Path = ROOT) -> list[str]:
         errors.append(f"component contract schema validation failed: {exc}")
     errors.extend(f"component contract semantic validation failed: {error}" for error in component_contract_semantic_errors(contract))
     core_sha = str(contract["consumer_integration"]["core_sha"])
+    workflow_sha = str(contract["consumer_integration"].get("site_deploy_workflow_sha", core_sha))
+    workflow_ancestor = subprocess.run(["git", "merge-base", "--is-ancestor", workflow_sha, "HEAD"], cwd=root,
+                                       stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+    if workflow_ancestor.returncode != 0:
+        errors.append("consumer integration workflow SHA must be an ancestor of the current source")
     core_object = subprocess.run(
         ["git", "cat-file", "-e", f"{core_sha}^{{commit}}"],
         cwd=root,
@@ -145,7 +174,7 @@ def validate(root: Path = ROOT) -> list[str]:
         if core_ancestor.returncode != 0:
             errors.append("consumer integration core SHA must be an ancestor of the current source")
         pinned_workflow = subprocess.run(
-            ["git", "show", f"{core_sha}:.github/workflows/site-deploy.yml"],
+            ["git", "show", f"{workflow_sha}:.github/workflows/site-deploy.yml"],
             cwd=root,
             text=True,
             stdout=subprocess.PIPE,
@@ -153,7 +182,7 @@ def validate(root: Path = ROOT) -> list[str]:
             check=False,
         )
         if pinned_workflow.returncode != 0:
-            errors.append("consumer integration core SHA does not contain the reusable deploy workflow")
+            errors.append("consumer integration workflow SHA does not contain the reusable deploy workflow")
         else:
             try:
                 pinned_deploy = load_workflow_text(pinned_workflow.stdout)
@@ -164,6 +193,14 @@ def validate(root: Path = ROOT) -> list[str]:
                     f"consumer integration workflow: {error}"
                     for error in reusable_deploy_input_errors(pinned_deploy)
                 )
+                if "deployment_contract" in contract and contract["components"]["mcp"]["release_status"] == "ready":
+                    recorded = subprocess.run(["git", "show", f"{workflow_sha}:src/unaltraweb_mcp/component-contract.json"],
+                                              cwd=root, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+                    try:
+                        provider_contract = json.loads(recorded.stdout) if recorded.returncode == 0 else {}
+                        errors.extend(selected_deployment_errors(contract, pinned_deploy, provider_contract))
+                    except (ValueError, KeyError, TypeError):
+                        errors.append("selected deployment workflow has no valid provider-owned component contract")
     if schema.get("properties", {}).get("schema_version", {}).get("const") != 1:
         errors.append("component contract schema does not select version 1")
 
@@ -183,6 +220,9 @@ def validate(root: Path = ROOT) -> list[str]:
     if make_value(root / "packaging/launcher/Makefile", "MCP_RELEASE_IMAGE") != component_reference("mcp"):
         errors.append("installed launcher must select its own package release image")
     project = pyproject.get("project", {})
+    dependencies = [*project.get("dependencies", []), *(entry for values in project.get("optional-dependencies", {}).values() for entry in values)]
+    if any(re.search(r"unaltracaptura[-_]qgis", str(entry), re.I) for entry in dependencies):
+        errors.append("Public Web wheel must not install the private QGIS package as a dependency")
     if "version" in project or project.get("dynamic") != ["version"]:
         errors.append("pyproject version must be derived from the package component contract")
     if pyproject.get("tool", {}).get("setuptools", {}).get("dynamic", {}).get("version", {}).get("attr") != "unaltraweb_mcp.__version__":
@@ -273,7 +313,7 @@ def validate(root: Path = ROOT) -> list[str]:
         "Makefile.tmpl": ["__MCP_IMAGE__", "__MANUAL_PDF_IMAGE__"],
         ".github/workflows/deploy.yml.tmpl": [
             "__SITE_DEPLOY_WORKFLOW__",
-            "__CORE_SHA__",
+            "__SITE_DEPLOY_WORKFLOW_SHA__",
             "__MANUAL_PDF_IMAGE__",
             "__VEGAVISUALS_SHA__",
         ],
@@ -486,7 +526,7 @@ def publish_ref_errors(
     default_branch: str,
     component_ids: list[str],
 ) -> list[str]:
-    errors: list[str] = []
+    errors: list[str] = practice_verifier.publication_errors(contract)
     release = contract.get("release", {})
     version = str(release.get("version") or "")
     release_tag = str(release.get("tag") or "")
@@ -561,6 +601,10 @@ def main(argv: list[str] | None = None) -> int:
         component_id for component_id, selected in contract["components"].items()
         if selected["release_status"] == "pending"
     )
+    verifier_errors = practice_verifier.publication_errors(contract)
+    if verifier_errors and practice_verifier.COMPONENT not in pending:
+        pending.append(practice_verifier.COMPONENT)
+        pending.sort()
     unavailable = sorted(
         component_id for component_id, selected in contract["components"].items()
         if selected["release_status"] == "unavailable"
@@ -583,6 +627,8 @@ def main(argv: list[str] | None = None) -> int:
         "errors": errors,
         "pending_releases": pending,
         "unavailable_releases": unavailable,
+        "practice_verifier": {"selection_ready": not verifier_errors, "errors": verifier_errors, "origin": "prepared-image",
+                              "private_checks": {"state": "not_run", "reason": "Public CI uses metadata/unit fixtures; native private acceptance and review are separate required gates"}},
     }, indent=2, sort_keys=True))
     readiness_errors = release_tag_errors + candidate_receipt_errors
     structural_errors = [error for error in errors if error not in readiness_errors]

data/scripts/validate_workflows.py

@@ -52,6 +52,9 @@ PYPI_PUBLISH_IMAGE = (
 )
 # Canonical JSON digest of the complete unprivileged verification job.
 PACKAGE_PUBLISH_VERIFY_POLICY_SHA256 = "e8d99c35040770a2b00d3c62497da637739e794310b253d1893078d048d51c48"
+# Canonical JSON of the complete provider-owned PDF digest/producer gate.
+# Extending its reviewed release records also requires published-worker tests.
+DEPLOY_PDF_PROVENANCE_POLICY_SHA256 = "da18b92db4069655e9979308dd90279ea8bfce4b77e47158efd5ac4421e06417"
 IMAGE_WORKFLOWS = {
     "compute-images.yml",
     "docker-image.yml",
@@ -119,14 +122,17 @@ def load_consumer_integration(root: Path) -> dict[str, Any]:
         "manual_pdf_image",
         "vegavisuals_sha",
     }
-    if not isinstance(integration, dict) or set(integration) != required:
+    if not isinstance(integration, dict) or not required <= set(integration) or set(integration) - required - {"site_deploy_workflow_sha"}:
         raise ValueError("component contract has no exact consumer_integration object")
+    integration = dict(integration)
+    integration.setdefault("site_deploy_workflow_sha", integration["core_sha"])
     return integration
 
 
 def load_scaffold_deploy(path: Path, integration: dict[str, Any]) -> dict[str, Any]:
     replacements = {
         "CORE_SHA": str(integration["core_sha"]),
+        "SITE_DEPLOY_WORKFLOW_SHA": str(integration["site_deploy_workflow_sha"]),
         "SITE_DEPLOY_WORKFLOW": str(integration["site_deploy_workflow"]),
         "MANUAL_PDF_IMAGE": str(integration["manual_pdf_image"]),
         "VEGAVISUALS_SHA": str(integration["vegavisuals_sha"]),
@@ -213,6 +219,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         integration = {
             "core_sha": "invalid",
             "site_deploy_workflow": "invalid",
+            "site_deploy_workflow_sha": "invalid",
             "manual_pdf_image": "invalid",
             "vegavisuals_sha": "invalid",
         }
@@ -1047,6 +1054,16 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         if marker not in ci_text:
             errors.append(f"ci.yml: missing required check {marker}")
     ci_docker = ci.get("jobs", {}).get("docker", {})
+    published_pdf_gate = _named_step(ci.get("jobs", {}).get("distribution", {}), "Test published PDF deployment provenance")
+    if published_pdf_gate != {
+        "name": "Test published PDF deployment provenance",
+        "env": {
+            "UNALTRAWEB_DEPLOY_PROVENANCE_DOCKER": "1",
+            "UNALTRAWEB_DEPLOY_PROVENANCE_SOURCE_SHA": "${{ github.event.pull_request.head.sha || github.sha }}",
+        },
+        "run": "PYTHONPATH=test python -m unittest test_deploy_provenance.PublishedDeployProvenanceTests",
+    }:
+        errors.append("ci.yml: published PDF deployment provenance must run unconditionally with real Docker")
     ruby_tests = str(_named_step(ci_docker, "Test all Ruby files").get("run") or "")
     if not all(
         marker in ruby_tests
@@ -1362,8 +1379,20 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
         for marker in ["MANUAL_PDF_IMAGE", "WORKFLOW_REPOSITORY", "WORKFLOW_SHA", "docker pull", "docker image inspect", "org.opencontainers.image.revision"]:
             if marker not in provenance_text:
                 errors.append(f"site-deploy.yml: PDF worker provenance check missing {marker}")
-        if '[[ "$image_revision" != "$WORKFLOW_SHA" ]]' not in provenance_text:
-            errors.append("site-deploy.yml: PDF worker revision label must be compared with the defining workflow SHA")
+        if '[[ "$image_revision" != "$expected_pdf_revision" ]]' not in provenance_text:
+            errors.append("site-deploy.yml: PDF worker revision label must be compared with its recorded producer SHA")
+        provenance_sha256 = hashlib.sha256(
+            json.dumps(provenance_step, sort_keys=True, separators=(",", ":")).encode()
+        ).hexdigest()
+        if provenance_sha256 != DEPLOY_PDF_PROVENANCE_POLICY_SHA256:
+            errors.append("site-deploy.yml: PDF digest/producer gate differs from the exact reviewed structure")
+        try:
+            contract = json.loads((ROOT / "src/unaltraweb_mcp/component-contract.json").read_text())
+            records = contract["deployment_contract"]["manual_pdf_workers"]
+            if sum(row.get("reference") == integration["manual_pdf_image"] for row in records) != 1:
+                errors.append("site-deploy.yml: selected PDF worker has no reviewed digest/producer record")
+        except (OSError, ValueError, KeyError, TypeError):
+            errors.append("site-deploy.yml: missing or invalid provider deployment records")
         if "docker pull" in provenance_text and "docker image inspect" in provenance_text and provenance_text.index("docker pull") > provenance_text.index("docker image inspect"):
             errors.append("site-deploy.yml: PDF worker digest must be pulled before its revision label is inspected")
         if "${{ github.workflow_sha }}" in deploy_text or "${{ github.workflow_repository }}" in deploy_text:
@@ -1542,7 +1571,7 @@ def validate_workflows(root: Path = WORKFLOW_ROOT) -> list[str]:
             action, separator, revision = uses.rpartition("@")
             if not separator or action != integration["site_deploy_workflow"] or not FULL_SHA.fullmatch(revision):
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow must use an immutable unaltraweb SHA")
-            elif revision != integration["core_sha"]:
+            elif revision != integration["site_deploy_workflow_sha"]:
                 errors.append(f"scaffold deploy.yml:{job_name}: reusable workflow SHA has not been reviewed")
             reusable_job = scaffold.get("jobs", {}).get(job_name, {})
             if reusable_job.get("needs") != "validate":

data/src/unaltraweb_mcp/component-contract.json

@@ -2,17 +2,43 @@
   "$schema": "component-contract.schema.json",
   "schema_version": 1,
   "release": {
-    "version": "0.7.0",
-    "tag": "v0.7.0"
+    "version": "0.7.2",
+    "tag": "v0.7.2"
   },
   "consumer_integration": {
     "schema_version": 1,
     "core_repository": "https://github.com/dosquartsdedocs/unaltraweb.git",
-    "core_sha": "216ab2e8b6b8b45a5bb7da0a54bffd10edee895d",
+    "core_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
     "site_deploy_workflow": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml",
-    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+    "site_deploy_workflow_sha": "3332e0b93933f12317e05f1ce8d38ce80046feab",
+    "manual_pdf_image": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
     "vegavisuals_sha": "a448cc50a5f511743a6fcfc213baeb9be80f4a27"
   },
+  "deployment_contract": {
+    "schema_version": 1,
+    "manual_pdf_workers": [
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:9e0b3a45753c170b795e9a9d6df61580085c113436beac5bf6c8de69b6562097",
+        "producer_sha": "d857f8c9f5fea90cf450c0b30b4e77a37b541275"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+        "producer_sha": "5cf9817489c8dc47cee726bfe42fe3071cd32b85"
+      },
+      {
+        "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
+        "producer_sha": "b7ec1d7a139c65b3b0b88699cdbeb19080f13be1"
+      }
+    ],
+    "caller_migrations": [
+      {
+        "id": "deploy-provenance-86",
+        "path": ".github/workflows/deploy.yml",
+        "baseline_sha256": "a789870542614d5817d30ea4328c7d1ad38d27443c009c68a48ad5aaa3106b8e",
+        "current_sha256": "c632a548d0782867be20a2a52fe03469cf63066b7364bace77fd54a226cb3b18"
+      }
+    ]
+  },
   "receipt_contract": {
     "schema_version": 1,
     "path_template": ".unaltraweb/receipts/{provider}.json",
@@ -29,17 +55,17 @@
     "package_only_commands": ["doctor", "import-calibre", "new-web", "version"],
     "factory_required_commands": ["factory-dir"],
     "package_only_mcp": ["artifact-import-check", "import-artifact-bundle", "bibliography-add-entry", "bibliography-inventory", "build-health", "content-approval-inventory", "content-freshness-check", "content-inventory", "detect-site", "editorial-policy", "editorial-publication-check", "editorial-review-prepare", "editorial-review-record", "editorial-review-resolve", "editorial-status", "html-audit", "http-check", "image-background-check", "initialize-site", "language-policy", "list-tools", "manual-authoring-capabilities", "manual-editorial-quality-check", "manual-pdf-preview-clean", "manual-source-quality-check", "new-web", "preview-start", "preview-status", "preview-stop", "profile-check", "profile-prune", "profile-prune-plan", "prose-check", "scaffold-sync", "site-context", "site-doctor", "site-source-delete", "site-source-read", "site-source-write", "starter-templates", "translation-plan"],
-    "factory_required_mcp": ["bibliometrics-check", "bibliometrics-fetch-scimago", "bibliometrics-update", "build-site", "manual-computation-check", "manual-computation-render", "manual-computation-render-figures", "manual-computation-status", "manual-pdf-build", "manual-pdf-preview-prepare", "manual-pdf-publish", "manual-pdf-status", "manual-release-check", "manual-release-prepare", "manual-release-status", "prompts", "serve", "site-check", "web-capture-check", "web-capture-render", "web-capture-status"],
-    "not_bundled": ["gem", "runtime", "mcp", "compute_python", "compute_r", "web_capture", "manual_pdf", "diavisuals", "vegavisuals"]
+    "factory_required_mcp": ["bibliometrics-check", "bibliometrics-fetch-scimago", "bibliometrics-update", "build-site", "manual-computation-check", "manual-computation-render", "manual-computation-render-figures", "manual-computation-status", "manual-pdf-build", "manual-pdf-preview-prepare", "manual-pdf-publish", "manual-pdf-status", "manual-practice-compose", "manual-practice-pdf-build", "manual-release-check", "manual-release-prepare", "manual-release-status", "prompts", "serve", "site-check", "web-capture-check", "web-capture-render", "web-capture-status"],
+    "not_bundled": ["gem", "runtime", "mcp", "compute_python", "compute_r", "web_capture", "manual_pdf", "diavisuals", "vegavisuals", "qgis_practice_verifier"]
   },
   "components": {
     "gem": {
       "kind": "gem",
       "name": "unaltraweb",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.2",
+      "release": "v0.7.2",
       "release_status": "ready",
-      "reference": "unaltraweb (= 0.7.0)",
+      "reference": "unaltraweb (= 0.7.2)",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
       "features": ["jekyll-core", "site-build"]
@@ -47,21 +73,21 @@
     "wheel": {
       "kind": "python-wheel",
       "name": "unaltraweb-mcp",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.2",
+      "release": "v0.7.2",
       "release_status": "ready",
-      "reference": "unaltraweb-mcp==0.7.0",
+      "reference": "unaltraweb-mcp==0.7.2",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": true,
-      "features": ["calibre-import", "doctor", "new-web", "offline-inspection", "mcp-control-plane"]
+      "features": ["calibre-import", "doctor", "new-web", "offline-inspection", "mcp-control-plane", "source-ci"]
     },
     "runtime": {
       "kind": "container",
       "name": "unaltraweb runtime",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.2",
+      "release": "v0.7.2",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.7.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.7.2",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -70,10 +96,10 @@
     "mcp": {
       "kind": "container",
       "name": "unaltraweb MCP runtime",
-      "version": "0.7.0",
-      "release": "v0.7.0",
+      "version": "0.7.2",
+      "release": "v0.7.2",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.2",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-mcp",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -118,15 +144,26 @@
     "manual_pdf": {
       "kind": "container",
       "name": "unaltraweb manual PDF worker",
-      "version": "0.6.0",
-      "release": "v0.6.0",
+      "version": "0.7.1",
+      "release": "v0.7.1",
       "release_status": "released",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
       "features": ["manual-pdf"]
     },
+    "qgis_practice_verifier": {
+      "kind": "companion",
+      "name": "unaltracaptura-qgis",
+      "version": "0.6.0",
+      "release": "v0.6.0",
+      "release_status": "released",
+      "reference": "https://github.com/dosquartsdedocs/unaltracaptura-qgis.git@v0.6.0",
+      "repository": "https://github.com/dosquartsdedocs/unaltracaptura-qgis",
+      "included_in_wheel": false,
+      "features": ["qgis-practice-v1", "qgis-practice-v2", "private-prepared-runtime"]
+    },
     "diavisuals": {
       "kind": "companion",
       "name": "diavisuals",

data/src/unaltraweb_mcp/component-contract.schema.json

@@ -7,7 +7,7 @@
   "required": ["schema_version", "release", "consumer_integration", "receipt_contract", "wheel_contract", "components"],
   "properties": {
     "$schema": {"type": "string"},
-    "schema_version": {"const": 1},
+    "schema_version": {"type": "integer", "const": 1},
     "release": {
       "type": "object",
       "additionalProperties": false,
@@ -22,14 +22,47 @@
       "additionalProperties": false,
       "required": ["schema_version", "core_repository", "core_sha", "site_deploy_workflow", "manual_pdf_image", "vegavisuals_sha"],
       "properties": {
-        "schema_version": {"const": 1},
+        "schema_version": {"type": "integer", "const": 1},
         "core_repository": {"const": "https://github.com/dosquartsdedocs/unaltraweb.git"},
         "core_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "site_deploy_workflow": {"const": "dosquartsdedocs/unaltraweb/.github/workflows/site-deploy.yml"},
+        "site_deploy_workflow_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"},
         "manual_pdf_image": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
         "vegavisuals_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
       }
     },
+    "deployment_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "manual_pdf_workers", "caller_migrations"],
+      "properties": {
+        "schema_version": {"type": "integer", "const": 1},
+        "manual_pdf_workers": {
+          "type": "array", "minItems": 1, "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["reference", "producer_sha"],
+            "properties": {
+              "reference": {"type": "string", "minLength": 117, "maxLength": 117, "pattern": "^ghcr\\.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:[0-9a-f]{64}$"},
+              "producer_sha": {"type": "string", "minLength": 40, "maxLength": 40, "pattern": "^[0-9a-f]{40}$"}
+            }
+          }
+        },
+        "caller_migrations": {
+          "type": "array", "uniqueItems": true,
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["id", "path", "baseline_sha256", "current_sha256"],
+            "properties": {
+              "id": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"},
+              "path": {"const": ".github/workflows/deploy.yml"},
+              "baseline_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"},
+              "current_sha256": {"type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[0-9a-f]{64}$"}
+            }
+          }
+        }
+      }
+    },
     "receipt_contract": {
       "type": "object",
       "additionalProperties": false,

data/src/unaltraweb_mcp/distribution.py

@@ -20,7 +20,15 @@ def _strict_json(path: Path) -> Any:
     def reject(value: str) -> None:
         raise ValueError(f"non-finite JSON number is not allowed: {value}")
 
-    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject)
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result:
+                raise ValueError(f"duplicate component contract key: {key}")
+            result[key] = value
+        return result
+
+    return json.loads(path.read_text(encoding="utf-8"), parse_constant=reject, object_pairs_hook=unique)
 
 
 def _schema_type_matches(value: Any, expected: str) -> bool:
@@ -155,6 +163,9 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     expected_workflow = f"{expected_core_repository.removeprefix('https://github.com/').removesuffix('.git')}/.github/workflows/site-deploy.yml"
     if integration["site_deploy_workflow"] != expected_workflow:
         errors.append("consumer integration deploy workflow must belong to the core provider")
+    workflow_sha = str(integration.get("site_deploy_workflow_sha", core_sha))
+    if re.fullmatch(r"[0-9a-f]{40}", workflow_sha) is None or workflow_sha == "0" * 40:
+        errors.append("consumer integration workflow SHA must be a nonzero full lowercase commit SHA")
     expected_pdf_prefix = f"{value['components']['manual_pdf']['image_repository']}@sha256:"
     manual_pdf_image = str(integration["manual_pdf_image"])
     if re.fullmatch(rf"{re.escape(expected_pdf_prefix)}[0-9a-f]{{64}}", manual_pdf_image) is None or manual_pdf_image.endswith("0" * 64):
@@ -162,6 +173,26 @@ def component_contract_semantic_errors(value: dict[str, Any]) -> list[str]:
     vegavisuals_sha = str(integration["vegavisuals_sha"])
     if re.fullmatch(r"[0-9a-f]{40}", vegavisuals_sha) is None or vegavisuals_sha == "0" * 40:
         errors.append("consumer integration Vega revision must be a nonzero full lowercase commit SHA")
+    deployment = value.get("deployment_contract")
+    if deployment is not None:
+        references = [row["reference"] for row in deployment["manual_pdf_workers"]]
+        if not 1 <= len(references) <= 64:
+            errors.append("deployment worker inventory must contain between 1 and 64 records")
+        if len(set(references)) != len(references):
+            errors.append("deployment worker references must be unique")
+        if manual_pdf_image not in references or value["components"]["manual_pdf"]["reference"] != manual_pdf_image:
+            errors.append("selected PDF worker must match a reviewed deployment record and the component reference")
+        for row in deployment["manual_pdf_workers"]:
+            if row["producer_sha"] == "0" * 40 or row["reference"].endswith("0" * 64):
+                errors.append("deployment worker identities must be nonzero")
+        migrations = deployment["caller_migrations"]
+        if len(migrations) > 32:
+            errors.append("deployment caller migration inventory exceeds 32 records")
+        if len({row["id"] for row in migrations}) != len(migrations) or len({(row["path"], row["baseline_sha256"], row["current_sha256"]) for row in migrations}) != len(migrations):
+            errors.append("deployment caller migrations must be unique")
+        for row in migrations:
+            if row["baseline_sha256"] == row["current_sha256"] or "0" * 64 in (row["baseline_sha256"], row["current_sha256"]):
+                errors.append("deployment caller migration requires distinct nonzero baseline and current hashes")
     return errors
 
 
@@ -194,7 +225,16 @@ def distribution_version() -> str:
 
 def consumer_integration() -> dict[str, Any]:
     """Return an isolated copy of the reviewed consumer runtime tuple."""
-    return dict(_contract()["consumer_integration"])
+    result = dict(_contract()["consumer_integration"])
+    result.setdefault("site_deploy_workflow_sha", result["core_sha"])
+    return result
+
+
+def deployment_contract() -> dict[str, Any]:
+    """Provider-owned identities and exact reviewed caller migrations."""
+    return json.loads(json.dumps(_contract().get("deployment_contract", {
+        "schema_version": 1, "manual_pdf_workers": [], "caller_migrations": [],
+    })))
 
 
 def component(component_id: str) -> dict[str, Any]: