unaltraweb 0.7.4 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66c0a140c30b1c7d9f1353efc62b28eb3c379649160ba68ad6b262d1f91ec90a
-  data.tar.gz: f6d0c69a53d4b1a5de92777335c6cd1705f4946fb6390cac260fcbeac7db3361
+  metadata.gz: bc478612d85e4f4f43eb203c048bce25f105fa320a56e66e41922627c1f4b4b3
+  data.tar.gz: 0d55b9e3743df94ae89dda1cf008d604873d6938ae3732a2b41edd8f03d64ea0
 SHA512:
-  metadata.gz: d3dff0655f66a91f8a56c301c2da3fd395ef4b2ef7cd33e80a2c858a86cb3a734058480d62bdfc7753663d93b44f2906076c8ce74a2504de1295856ae2b1cf04
-  data.tar.gz: 9e8ffdb6047bde3d209f47fe339dcb97fe3d60ca365468cc7a056860b041c7e1823b9c47e7974da3f20e7be0e0c0719f986a617318876f64556e551c169a71e6
+  metadata.gz: 2ee71521b81afc077773b375120d39ca2e00fbaa926f287ee6df2e2c6356c10524f4b67346298f0dd647ee182f2c0fb2e45940faadaf9a0e4c336eab697aa85a
+  data.tar.gz: fc0f4072ce20853d839c46b0cab1c305f5dfc43bf61d83d58ebb13e552f708ad2d16e4473f4f454829c9206857b66b3279d38ba7f7e110845053fa0942d8497a

data/Makefile

@@ -1,9 +1,9 @@
 PYTHON ?= python3
 override PROJECT := $${MCP_CONSUMER_WORKSPACE:?MCP_CONSUMER_WORKSPACE is required}
 override PROJECT_ROOT := $(PROJECT)
-MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.4
-MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.4
-MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8183e7117f5902fc0ad4d930b757d874b2da1f93d5ef4db102ae4c1b03e357a3
+MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.1
+MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.8.1
+MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08
 MCP_DOCKER_BUILD_NETWORK ?= default
 INIT_SITE_PROFILE ?= unaltreselfie
 NEW_WEB_PROFILE ?= unaltreselfie
@@ -40,7 +40,7 @@ WEB_CAPTURE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-web-capture@sha256:0bf1b
 WEB_CAPTURE_DEV_IMAGE ?= unaltraweb-web-capture:dev
 WEB_CAPTURE_DOCKER_BUILD_NETWORK ?= default
 VEGAVISUALS_CLI ?=
-DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.4
+DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.1
 MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
 MANUAL_PDF_DEV_IMAGE ?= unaltraweb-manual-pdf:dev
 MCP_SMOKE_MANUAL_PDF_IMAGE ?= $(MANUAL_PDF_IMAGE)

data/docs/_documentation/en/47-manual-context.md

@@ -0,0 +1,140 @@
+---
+title: Export Manual Context for Itemarium
+description: Portable, producer-resolved manual text and figures with immutable provenance.
+lang: en
+ref: manual_context_export
+profiles:
+  - unaltredocs
+documentation_profiles:
+  - site-authors
+  - core-developers
+section: Manuals
+weight: 470
+permalink: /manual-context/
+---
+
+Version **0.8.0** introduces `manual_context_export`. Version 0.7.4 and
+already-running MCP sessions do not acquire it from a checkout edit.
+Implementation and interoperability are tracked in
+[issue #121](https://github.com/dosquartsdedocs/unaltraweb/issues/121).
+
+## Select the manual
+
+Use a connection bound to the manual workspace. Set a stable, author-owned
+`unaltraweb.manual.id` in `_config.yml`; retain it across revisions and relocation.
+The title is `unaltraweb.manual.title`, falling back to the site title. Each
+chapter needs a unique `ref`, a title, and its configured language. Explicit
+heading IDs such as `## Method {#method}` remain stable across title edits.
+
+```python
+manual_context_export(name="itemarium-review-01", language="ca", chapters=["first"])
+```
+
+The equivalent factory-backed CLI is:
+
+```bash
+unaltraweb-mcp --project /absolute/manual mcp manual-context-export \
+  --name itemarium-review-01 --language ca --chapter first
+```
+
+`--chapter` is repeatable and preserves manual order. `--section first#method`
+selects one **exact block**, not its descendants; repeat it for additional blocks.
+The MCP arguments are `chapters` and `sections` arrays. Omitting them selects all
+chapters/blocks in the requested language. Unknown or duplicate selections fail.
+
+## Delivery and retention
+
+Exports are retained under `tmp/manual-context/<name>/`: `content/`, the flat
+`manual-context.tar.gz` and a receipt sealed last. This directory must be ignored
+by Git. An existing name is never replaced, even after a failed or interrupted
+export. The result returns the workspace-relative `path`, actual `sha256`, receipt
+path/hash, producer/manual identities and counts. Only the tar and its SHA are
+needed by Itemarium; no source checkout access is necessary.
+
+The archive contains exactly `manual-context.json`, `sections/...md`, and
+`figures/...`. Image references use `/figures/...`. The schema is available at
+`web://manual-context-schema`. Each heading's file ends before the next heading,
+so parent blocks do not duplicate descendant prose. Order is explicit rather
+than inferred from filenames. Numbered chapters precede reference chapters, as
+in the native manual resolver; public `pdf: false` chapters remain available.
+
+The exporter resolves native figures, localized variants/fallback and the
+existing output precedence on a bounded no-follow snapshot. It reuses native
+computation status (including generated chapters), complete companion receipts
+for diagrams/Vega, and web-capture status. These project-wide completeness checks
+also reject unrelated stale/orphaned records; selecting a chapter cannot bypass
+a required producer gate. Unmanaged generated outputs are not freshness evidence.
+
+Literal Markdown/HTML includes without parameters, manual bibliography includes,
+`cite` tags, tables, subfigures, listings, callouts and definition lists are
+projected to portable prose. Captions, credits and bibliography fields/links are
+retained; the exporter does not emulate a CSL citation style. Code examples stay
+literal. HTML comments are not reader-facing context. Arbitrary Liquid, dynamic
+includes and active/interactive HTML need an explicitly prepared portable source
+and fail with a diagnostic rather than disappearing.
+
+No renderer or download runs implicitly. Standalone PNG/JPEG/GIF/WebP/SVG images
+are accepted. The current receiver rejects SVG `<image>`, even embedded PNG data
+in capture SVGs, and excludes PDF. A current native web-capture SVG can pass only
+if its effective bytes meet this standalone boundary. QGIS capture provenance
+has no native context-v1 adapter in this increment: recognizable QGIS captures
+are refused with a diagnostic, not relabelled as static. Its profile/receipt
+integration and receiver support for raster-bearing SVG require coordinated
+follow-up. Edited captures are never silently substituted with original rasters.
+
+### Candidate 0.8.1: check-only computation dependencies
+
+The 0.8.1 source candidate separates explicitly declared native computation
+inputs/environment fingerprints from public content selection. Durable literal
+project-relative inputs, including `_practices/<project>/data/...` and root-level
+`Dockerfile.compute-*` / `requirements-compute.*`, are checked through the same
+bounded no-follow reader and native freshness checks. They do not become public
+image/include/output sources. Hidden paths, broad private roots and transient or
+dependency-installation roots (`tmp`, `sandbox`, `dist`, `node_modules`, `vendor`)
+remain refused. Reader and transport byte limits are unchanged.
+
+Only their hashes participate in the source fingerprint and external producer
+receipt. Private input bytes and paths do not enter the transport. Global
+completeness, stale-input checks and final rechecks still apply when selecting a
+single chapter. The candidate also restores inline-code tokens in HTML image
+alt/title/credits before recording metadata and figure identity. Published 0.8.0
+does not contain these repairs; use the newly qualified release after publication
+and explicit adoption. The v1 schema and SVG/PDF/QGIS restrictions remain unchanged.
+
+Diagrams use the provider's exact effective-artifact receipt. Vega uses exactly
+the output declared in `.vegavisuals.yml` (including an edited output only when
+that is the declared, verified output). Computation SVG overrides must postdate
+their current source and generated base. Web captures use their native embedded
+PNG/fingerprint checks. The exporter records fresh resolution evidence binding
+the native check **and the actual effective bytes**; `receipt_sha256` refers to
+that evidence in the retained export receipt, not an older renderer receipt
+misattributed to new edited bytes.
+
+`manual.revision` is the actual Git HEAD and `dirty` is explicit. Clean source
+dates use the commit date; dirty snapshots use the latest consumed file mtime,
+with an explicit timezone. The source fingerprint is SHA256 of canonical UTF-8
+JSON (sorted keys, compact separators, no trailing newline) mapping consumed
+project-relative paths to their hashes: configuration, manual collection inputs,
+referenced includes/bibliography, original and effective visuals, dependency
+files, native locks and complete provider check inventories. Only resolved text
+and registered images enter the transport archive; executable/data/check inputs
+are represented by fingerprints in the producer receipt. Absent variant probes are retained in
+the external producer receipt and rechecked before sealing. The package's direct
+file hashes independently bind every delivered byte. Producer revision is a
+code fingerprint of the package and native resolver/check scripts, not a claim
+that a development build is a published release.
+
+## Interoperability test
+
+Core maintainers can produce retained synthetic manuals through the actual MCP:
+
+```bash
+python scripts/test_manual_context_export.py --output /absolute/unaltraweb/tmp/context-run-01
+```
+
+The script emits first/next package paths and sender hashes. Pass those exact
+files to Itemarium's `tools/desktop/manual_package_conformance.py`, using an
+Itemarium-capable Python and a new output directory under unaltraweb's `tmp/`.
+The producer receipt proves exporter invocation; the independent consumer receipt
+proves schema/closure, import, preservation and backup/reopening. Neither test
+creates questions or certifies a teaching bank's quality.

data/docs/agents/manual-context-121.md

@@ -0,0 +1,191 @@
+# Manual context producer — #121
+
+Workspace: `/home/benizar/git/unaltraweb`; branch `feat/121-manual-context-export`.
+The initial [PR122](https://github.com/dosquartsdedocs/unaltraweb/pull/122) contained the
+post-release pin (`59bd62b`), first bound exporter (`cbf7260`) and resolver/check
+continuation. That initial delivery preceded the authorized integration and
+publication recorded below.
+
+## Interface and contract
+
+- MCP: `manual_context_export(name, language="", chapters=None, sections=None)`.
+- CLI: `unaltraweb-mcp --project /absolute/manual mcp manual-context-export
+  --name RUN [--language ca] [--chapter REF ...] [--section REF#ANCHOR ...]`.
+- Resource: `web://manual-context-schema`.
+- The export uses its connection's workspace; the MCP has no root argument.
+- `unaltraweb.manual.id` is an explicit stable logical identity. Text selection
+  preserves refs, native order and exact non-overlapping blocks; section selection
+  is exact, not an implicit subtree expansion.
+- The schema bytes match Itemarium's supplied v1 exactly:
+  `e099d6f01af87a9f95ae828a8abc5ef69fb61f8d3fdfb8e5886d478cb60bd1c8`.
+- Production has no Itemarium dependency. Native factory helpers are required,
+  as declared by the wheel/CLI contract. A bounded snapshot, native statuses,
+  complete provider receipts and final source/identity rechecks precede sealing.
+
+See the [author guide](../_documentation/en/47-manual-context.md) for supported
+components, fingerprint closure, retention, limits and refusal remediation.
+
+## Acceptance evidence
+
+First actual exporter invocation (one chapter, three blocks, one static PNG):
+
+- `tmp/manual-context-121-first/manual-fixture/tmp/manual-context/v1/manual-context.tar.gz`
+- SHA256 `414327f240684aa3e66f609d00017d9e1b8d6ced5a0ec7de4d0d0dd53e0bb256`.
+- `tmp/manual-context-121-first-conformance/receipt.json`: consumer check, import
+  and backup/reopening passed. This early artifact predates the additional guards
+  and generated-resource adapter; it is retained separately from final evidence.
+
+Final producer test used the installed package in an explicitly built, network-
+disabled, read-only-root Docker MCP, with only its synthetic manual mounted:
+
+- Image ID `sha256:f01c5e220ad635588d0e545eb3294e8550da71c90a59eaab9a91ad7d334c8873`.
+- Producer version **0.8.0 development**; code revision
+  `sha256:322eb2f79d7c275c0dc9e6ce554a7d4fa82f63cb8a259cdd4b3413ecc5b3ca56`.
+  The host source fingerprint matches this observed installed producer exactly.
+- Both stdio instances expose the bound tool, refuse a second use of the export
+  name, drain, close and leave their exact fixture container absent.
+- The real CLI also exported one selected block with its figure successfully.
+- Producer receipt: `tmp/manual-context-121-final/producer-receipt.json`, SHA256
+  `8482b2c44dc5885a683a94314f59c0077f104e58c0f6312f2c2454c8512b41a0`.
+
+Packages below `tmp/manual-context-121-final/manual-fixture/`:
+
+| Version | Path | SHA256 |
+| --- | --- | --- |
+| First: 1 chapter / 3 blocks / 1 figure | `tmp/manual-context/v1/manual-context.tar.gz` | `4ecb3014dc57c66962bead52c8ab42a1233e23c8ddc29c3bb5cecf82cc6801b3` |
+| Next: 2 chapters / 4 blocks / 1 figure | `tmp/manual-context/v2/manual-context.tar.gz` | `b60909760352c74b921d077924a05f873d3cf144ae6aabf906e100b9b3a824d4` |
+
+Both have manual ID `fixture-manual-121`, language `ca`, `dirty:false`; source
+revisions are `4f507b56ba2fcdb3fc59f727066427639776841d` and
+`5165919651d1140b7382d5f148e84fa54feb67fc`. Fingerprints change with the sources;
+refs and the prior bank remain stable.
+
+Itemarium's independent runner consumed **these exact two exporter archives**:
+
+- Engine 0.6.2, source SHA256
+  `1a8983100c4b0c72bac74912fdde7a4d8ad14ce9970e188f13aae611dbeee813`.
+- Receipt: `tmp/manual-context-121-final-conformance/receipt.json`, SHA256
+  `f5a5579377f3513f6b1d2e796cb8c99723dabe530f9de6425da517f36e13aad3`.
+- PASS: schema/integrity/resource closure; isolated import; preservation of all
+  existing bank state when the second version adds one bank; backup reopening in
+  a second app after removal of the first fixture app.
+- Backup SHA256 `ed8062db688001911bcdca68c23d33135208bfdc89375e1f3a7c1df843016bd0`.
+- The consumer's `producer_export_invoked:false` correctly describes its own
+  runner; the separate producer receipt proves actual MCP export invocation.
+  No manual checkout was supplied to Itemarium. No questions or real teacher data
+  were used; functional conformance is not teaching-bank quality certification.
+
+## Checks and observations
+
+- Full suite: **763 cases, 735 passed, 28 expected skips** with the prepared Python
+  environment (`PATH=.../public-env/bin:$PATH PYTHONPATH=src python3 -m unittest
+  discover -s test -p 'test_*.py'`). The bare system Python lacks existing pypdf /
+  tinycss2 dependencies; that failed attempt is not a passing suite.
+- 21 exporter cases cover static/HTML figures, language fallback and translated
+  diagrams, components/includes/citations, generated chapter/computation checks,
+  edited byte evidence, Vega local-data receipts, web captures, stale/modified/
+  unmanaged/missing outputs, unsafe resources, concurrent changes and retention.
+  Generated-resource unit fixtures carry synthetic native records; they do not
+  claim fresh renderer execution.
+- `distribution-check`, `workflow-check`, clean installed `wheel-check`: PASS.
+- `make mcp-check`, `make mcp-smoke`: PASS.
+- `make docs-build DOCKER_IMAGE=unaltraweb:dev`: PASS; prose check of the new guide:
+  no findings. The initial default-image docs command refused unpublished 0.8.0.
+- Gem build/package inspection: PASS inside the prepared MCP image with its Ruby,
+  network disabled and source mounted read-only. The host-only default attempt
+  refused the unpublished 0.8.0 runtime rather than pulling it.
+- `git diff --check`: PASS. Initial CI's old hardcoded 0.7.3 launcher expectation
+  was updated to the verified 0.7.4 digest; no release gate was relaxed.
+
+## Remaining integration boundaries
+
+The receiver refuses all SVG `<image>` nodes, including embedded PNGs, and PDF.
+Native capture freshness is checked, but such effective assets are refused rather
+than rasterized or substituted. QGIS context-v1 provenance has no adapter in this
+increment; recognizable QGIS captures get an explicit unsupported diagnostic.
+Interactive/arbitrary Liquid and undeclared outputs also fail closed. These
+limitations are recorded on #121 for producer/receiver coordination.
+
+At initial source delivery, version 0.8.0 had publication status **pending**. The checkout
+launcher then selected published 0.7.4; observation of this conversation's existing
+MCP still showed installed **0.7.3**, instance `ecac06618bd3436794e89c31746b8914`,
+bound to this checkout. It was not hot-reloaded or rebound. Hub admission belongs
+to gaContExt #52, and real-manual selection/author review remain separate.
+
+The #116 checkpoint remains on `feat/116-common-practice-sdk`; it is not included
+in this branch or attributed to these exports.
+
+## Authorized publication follow-up — 2026-11-03
+
+After the source delivery above, the user authorized continuing toward hub
+integration. PR122's final source and both CI runs remain green. Itemarium also
+independently rechecked the exact exporter archives in network-disabled isolation
+with no manual checkout: all four conformance checks passed, receiver receipt
+`15b8561e1e55899b57d8e45b8d19b7a8eeaa669808cf729d29eac3589a3231fb`
+([receiver return](https://github.com/dosquartsdedocs/unaltraweb/issues/121#issuecomment-6597815786)).
+
+The four new Web components were marked release-ready for the normal signed
+candidate, receipt-only merge/tag and trusted publication workflow. Independent
+core/gem, workflow, PDF and QGIS selections retain their previously verified
+identities. This source readiness is not a claim of published bytes or admission.
+
+GaContExt #52 specifically concerns admitting newer **Itemarium** native builds.
+The new Web tuple must also be delivered to the hub owner after publication;
+neither publication alone nor the existing consumer conformance receipt proves
+hub admission, selected-client activation or an export of a real teaching manual.
+
+## Published 0.8.0 and verified intake
+
+[Release v0.8.0](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.8.0)
+is published. PR122 supplies source `54afe7588c36e959a7eb75d5f52763a7456108d7`;
+receipt-only PR123 supplies tag target `f71aeea75e11f4c2b15df4451f47ddd8a161bd8b`.
+Annotated tag object: `eca74d75783bd6630a47376bd1a3076912a1a087`.
+Receipt SHA256: `a2bf883ea62a4f164c925fa477e756378d0590f8dc6bbcdc54c17b645a7896da`.
+
+- Wheel: `4dcec737596b4e4742e04b50a70b81d04ffadf993139e6ba1d1bce665ece4816`.
+- Gem: `bbc3dbbc106b69d7a677608c46bf1d4f64d7016a48b27301022ec71e5a378f79`.
+- Controller OCI: `ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08`.
+- Controller config ID: `sha256:e0502369c85c59f9e512fbd9fdb17dbc128845d057a1423375425e68ce2e79a2`.
+- Runtime OCI: `ghcr.io/dosquartsdedocs/unaltraweb@sha256:d58d8f68cf08a76e9b9f3ef238a0917b856cf7152aa5cc4a6f54ca109e1ac3fe`.
+- Runtime config ID: `sha256:c0ec72478618c3e7a9444cd7ae9120317a18757019b2fbf8f0438ca451695731`.
+
+Complete [release-handoff.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/release-handoff.json),
+SHA256 `7a7cab1d48e3302af5f21309e57b540d7ca81eb4d8c0f36c7a5da7099538a53a`,
+lists every asset, untagged Docker archive, independent worker and native profile.
+Core `9d97197` / gem 0.7.3, workflow `3332e0b`, PDF 0.7.1 and classic QGIS 0.6.1 are preserved.
+
+Signed candidate run `41641425949`, package preparation `41641430158`, Trusted
+Publishing `41687937608`, OCI promotion `41687938131` and tag CI `41687888720`
+passed. The exact controller's 40 package modules match the CI wheel. Its new
+code fingerprint is `sha256:a678d2b2649e3479d0049ca0ca8a500aba5bb3f0a59b070cd7aaf5c0c6b466d0`;
+the earlier development image/receipts above are retained as their own evidence.
+
+The exact installed release controller exported two new fixture packages:
+`9bc3b4506a3f04c66631e7bcc3617b558879af95ee29f6c3b8fead870826afa7` and
+`7225f7c00f0992c922048608b622eec9a9d6d4b6a1c18049b32c2b5ffba7eb40`.
+Itemarium 0.6.2 again passed all four checks on these exact bytes. Release assets
+`producer-acceptance.json` and `consumer-conformance.json` have SHA256
+`4a8ae9db55757b584b24b9b1602ffe94e566cd4531016a073c7afc31e78f4e48` and
+`af73eba0cee0c447072df269572c22164dd8aca2eb0ea73e2416170056cd4e63`.
+
+All 18 original assets were downloaded anonymously and hash/size checked,
+including both image archives; PyPI/RubyGems copies and OCI aliases matched.
+[verification.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/verification.json)
+has SHA256 `ec04ac1714a1b00c2f8e14f415e0fb0e21a195e42c5848ce53694ce0b85ed403`.
+The downloaded public wheel was installed in a fresh environment: actual MCP
+discovery reports 65 tools, its bound exporter produces a valid package, and
+Itemarium's independent check passes without importing it.
+[public-installation.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/public-installation.json)
+has SHA256 `b94920fd618d50ba384207d3e2a126ccd4b1cf98b697760d4d27c09f6b80cf75`.
+
+Post-release verification of the updated checkout pin passes distribution/workflow
+checks, the public-image bootstrap check/smoke and the full local suite: 763 cases,
+736 passed and 27 skips in that prepared environment.
+
+The post-release checkout pin now selects the published 0.8.0 controller. The
+configured hub's immutable `cbb753e4…` controls still admit Web only through 0.7.4;
+this is an observed admission boundary, not a missing producer release. The full
+intake is [gaContExt #54](https://github.com/dosquartsdedocs/gacontext/issues/54),
+alongside Itemarium's separate #52. No hub registry, other client registration or
+real manual was changed here. Source selection, hub admission and live client
+activation remain distinct.

data/docs/agents/manual-context-fix-121.md

@@ -0,0 +1,130 @@
+# Minimal #121 producer repair: P1 + P2
+
+Coordination request:
+`gacontext-itemarium-readiness-20261104-unaltraweb-02290003fd784c20a1659f4f803839ef`.
+
+Authoritative workspace: `/home/benizar/git/unaltraweb`. Branch
+`fix/121-context-inputs-html` starts from the preserved review125 at
+`b67a51292f680d3bc0058b272c68116c3fd75bc4`; clean preflight was ELIGIBLE.
+The review branch and experimental116 at
+`6a8cd85ff75c8ad41dc67f8fb1c3c5a8f8919e53` remain intact. No other checkout,
+registry, real manual or teacher bank is modified by this unit.
+
+## Implemented repairs
+
+**P1:** `Snapshot.computation_input` validates declared check-only dependencies
+separately from public sources. Only native computation input/environment
+declarations use this path. Existing descriptor-relative no-follow reads,
+per-file/total budgets, complete native status checks and final input/inventory
+rechecks are reused. No rendering or native source execution is introduced.
+
+The private practice root stays forbidden to images/includes/outputs, even if a
+caller attempts to name it as the manual collection. Opaque inputs remain outside
+the archive; fingerprints and external retained receipts bind their exact bytes.
+The same role correction supports TIGIT's explicitly declared root environment
+files `Dockerfile.compute-python`, `Dockerfile.compute-r`,
+`requirements-compute.txt` and `requirements-compute.R`. This avoids merely moving
+the first private-data error to the next environment-file error.
+
+**P2:** HTML `alt`, `title` and `data-caption-source` values are restored before
+`figure()` stores metadata and computes the ID, just as Markdown attributes were.
+Tests assert exact text and identity stability when unrelated inline code is added.
+
+No general Liquid extension, SVG raster policy, QGIS provenance adapter, W1
+integration or Geo collector is included. Existing typed refusal envelopes and
+v1 schema remain unchanged.
+
+## Tests and actual producer/receiver execution
+
+- 30 targeted context cases, including private input success, no private payload
+  or path leakage, global checking for an unrelated selected chapter, missing/
+  changed data, root environment fingerprints, symlink/traversal/hidden-root
+  refusals, unchanged 10 MiB reader limit and private-collection refusal.
+- Full local suite during implementation: **771 cases, 743 passed, 28 skips**;
+  the final declaration-type regression is additionally covered in the 30-case
+  targeted pass. Final-head CI retains the repository-wide gate.
+- `distribution-check`, `workflow-check`, `make mcp-check`, `make mcp-smoke`: PASS.
+  Base runtime and PDF toolchain layers were cached; only MCP/package layers and
+  small metadata were rebuilt for the successive fixes.
+  Disk observation: 15 GiB before, 14 GiB after verification. No global cleanup.
+- The acceptance runner has an explicit `--private-inputs-html` fixture mode.
+  It uses synthetic native computation records (not a claim of computation
+  rendering), a private input sentinel and the formerly broken HTML caption.
+  The **real MCP exporter** creates both transport archives. Assertions inspect
+  their exact manifests/closure, restored attributes, absence of private bytes/
+  paths/tokens and create-only behavior. A real CLI selects one block as well.
+
+Installed candidate controller:
+`sha256:b5b6c1e7816623a63c3340b97195253ff612458cf4b96ed443fafad2a1369bac`.
+Producer version **0.8.1 candidate**, fingerprint
+`sha256:2f82f9adb62a7111229e270772f00c1276ec546e9e42e4ad54e32e86e2a8ebdf`.
+The isolated stdio containers have read-only rootfs, disabled network, no Docker
+socket, and only their synthetic manual mounted. Both close and are confirmed absent.
+
+Evidence below `tmp/context-p1p2-acceptance-qualified/`:
+
+| Artifact | SHA256 |
+| --- | --- |
+| `producer-receipt.json` | `a610e07bc6a369079406ea93edc02581b2ec6dcbe82506ad314ed0920fec46b6` |
+| `manual-fixture/tmp/manual-context/v1/manual-context.tar.gz` | `8a53b2721e24544ba45ee18b8535f298691cb857054cd7ed12189d610007c971` |
+| `manual-fixture/tmp/manual-context/v2/manual-context.tar.gz` | `971d22218e3b407825643f63e524c6438a378e6a90db624afa689e4b1d66a8b9` |
+
+Itemarium's independent source runner 0.6.2 (engine
+`1a8983100c4b0c72bac74912fdde7a4d8ad14ce9970e188f13aae611dbeee813`) consumes
+these exact exporter archives and passes all four checks: integrity/closure,
+isolated import, existing-bank preservation and backup/reopening. Receipt:
+`tmp/context-p1p2-conformance-qualified/receipt.json`, SHA256
+`1660f7c576aa52e6f9fbcb39ec7d15a3a6b3c56b3a8dd63b4e2d1017d24bd9b9`.
+The source-mode preliminary run remains separately retained under
+`tmp/context-p1p2-acceptance-01` / `tmp/context-p1p2-conformance-01`; it predates
+the 0.8.1 metadata and is not relabelled as installed-candidate proof. Intermediate
+`-081` and `-081-final` runs are also retained; the qualified run includes the
+HTML entity-decoding and typed-declaration corrections. Protected HTML entities
+are decoded once without double-decoding surrounding attribute text.
+
+## Reproduction and next intake
+
+From this checkout with a prepared Python environment and the candidate image:
+
+```bash
+python scripts/test_manual_context_export.py \
+  --output /absolute/unaltraweb/tmp/new-p1p2-acceptance \
+  --private-inputs-html --image <exact-prepared-controller-ID>
+```
+
+Feed its returned first/next paths and hashes directly to Itemarium's documented
+`manual_package_conformance.py`, with a fresh output below Web's `tmp/`. Never
+manufacture replacement archives. These tests qualify the implementation; they
+do not substitute for the real TIGIT owner's subsequent export and bank workflow.
+
+Source metadata proposes **0.8.1** for package/gem artifact/controller/runtime,
+with publication status `ready` after explicit closeout authorization. The existing public checkout pin stays on
+0.8.0 until a new immutable publication is verified. Independent selections:
+
+- Native Git core `9d97197dec5fc9346ab795191a3afd18884c27fb`, gem **0.7.3**.
+- Workflow `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+- PDF **0.7.1**, OCI `sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+- Classic QGIS **0.6.1**, descriptor and controller/engine IDs unchanged.
+
+Required next gates: review/integration, exact signed candidates and receipt-only
+publication, cold installed proof, then a new reviewed hub intake. The local image
+is not a published or admitted point. TIGIT keeps its current activated0.8.0
+selection until explicit adoption, and must report a real export's path/SHA/receipt
+or the next exact blocker. No real TIGIT package is claimed by this fixture proof.
+
+## Follow-up review: opaque YAML dependencies
+
+PR126 discussion `4471006805` was reproduced on `b582c998`: a declared
+`_practices/course/data/parameters.yml` with valid YAML anchors and a current
+synthetic native computation receipt failed in `Snapshot.copy`. Check-only
+dependencies now pass `opaque=True`; Reader confinement, budgets, hashes and
+final source checks remain shared. Configuration reads still scan YAML even
+when a previous opaque read has already staged the file.
+
+The regression exports the anchored dataset without transporting its private
+bytes/path, then rejects its changed fingerprint. A separate regression refuses
+anchors on a configuration read after an opaque copy and in `_config.yml`.
+The installed-export harness also includes anchored YAML alongside the CSV
+input. Full local suite: 774 tests, OK (28 skipped). Earlier candidate hashes
+above remain historical; the changed source requires fresh installed-candidate
+and receiver evidence before publication.