unaltraweb 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4da9160082bd9c84936be79042fb12dcd6b08de75353196d34079d77e2abc55c
-  data.tar.gz: fb9d3fb95a69e51d6c430f612baf9cf426a694c4b9c986de30e60ff3e652b765
+  metadata.gz: bc478612d85e4f4f43eb203c048bce25f105fa320a56e66e41922627c1f4b4b3
+  data.tar.gz: 0d55b9e3743df94ae89dda1cf008d604873d6938ae3732a2b41edd8f03d64ea0
 SHA512:
-  metadata.gz: 8949f58e89b5ade9255639ff6d2b43df2bce76401b989662059922c948bca7be1e63f6da6b9e623ef9587e5f8820d82492c06c3c7e226c6ee1055d17f783f243
-  data.tar.gz: 2999667915dfbfb58da97468780057a1a0a78d29054894fd70bc4d7d8e4ab096f662cee9f40043fc92111df3e9171b50b4884a7dde1916a1bd8fcc798493295a
+  metadata.gz: 2ee71521b81afc077773b375120d39ca2e00fbaa926f287ee6df2e2c6356c10524f4b67346298f0dd647ee182f2c0fb2e45940faadaf9a0e4c336eab697aa85a
+  data.tar.gz: fc0f4072ce20853d839c46b0cab1c305f5dfc43bf61d83d58ebb13e552f708ad2d16e4473f4f454829c9206857b66b3279d38ba7f7e110845053fa0942d8497a

data/Makefile

@@ -1,9 +1,9 @@
 PYTHON ?= python3
 override PROJECT := $${MCP_CONSUMER_WORKSPACE:?MCP_CONSUMER_WORKSPACE is required}
 override PROJECT_ROOT := $(PROJECT)
-MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.0
-MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.8.0
-MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:10bcaf1411f27a518969283a77e23dcc99119014b216270b3089ba85ba0b6c7e
+MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.1
+MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.8.1
+MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08
 MCP_DOCKER_BUILD_NETWORK ?= default
 INIT_SITE_PROFILE ?= unaltreselfie
 NEW_WEB_PROFILE ?= unaltreselfie
@@ -40,7 +40,7 @@ WEB_CAPTURE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-web-capture@sha256:0bf1b
 WEB_CAPTURE_DEV_IMAGE ?= unaltraweb-web-capture:dev
 WEB_CAPTURE_DOCKER_BUILD_NETWORK ?= default
 VEGAVISUALS_CLI ?=
-DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.0
+DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.8.1
 MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
 MANUAL_PDF_DEV_IMAGE ?= unaltraweb-manual-pdf:dev
 MCP_SMOKE_MANUAL_PDF_IMAGE ?= $(MANUAL_PDF_IMAGE)

data/docs/_documentation/en/47-manual-context.md

@@ -82,6 +82,25 @@ are refused with a diagnostic, not relabelled as static. Its profile/receipt
 integration and receiver support for raster-bearing SVG require coordinated
 follow-up. Edited captures are never silently substituted with original rasters.
 
+### Candidate 0.8.1: check-only computation dependencies
+
+The 0.8.1 source candidate separates explicitly declared native computation
+inputs/environment fingerprints from public content selection. Durable literal
+project-relative inputs, including `_practices/<project>/data/...` and root-level
+`Dockerfile.compute-*` / `requirements-compute.*`, are checked through the same
+bounded no-follow reader and native freshness checks. They do not become public
+image/include/output sources. Hidden paths, broad private roots and transient or
+dependency-installation roots (`tmp`, `sandbox`, `dist`, `node_modules`, `vendor`)
+remain refused. Reader and transport byte limits are unchanged.
+
+Only their hashes participate in the source fingerprint and external producer
+receipt. Private input bytes and paths do not enter the transport. Global
+completeness, stale-input checks and final rechecks still apply when selecting a
+single chapter. The candidate also restores inline-code tokens in HTML image
+alt/title/credits before recording metadata and figure identity. Published 0.8.0
+does not contain these repairs; use the newly qualified release after publication
+and explicit adoption. The v1 schema and SVG/PDF/QGIS restrictions remain unchanged.
+
 Diagrams use the provider's exact effective-artifact receipt. Vega uses exactly
 the output declared in `.vegavisuals.yml` (including an edited output only when
 that is the declared, verified output). Computation SVG overrides must postdate

data/docs/agents/manual-context-121.md

@@ -1,9 +1,10 @@
 # Manual context producer — #121
 
 Workspace: `/home/benizar/git/unaltraweb`; branch `feat/121-manual-context-export`.
-[Draft PR122](https://github.com/dosquartsdedocs/unaltraweb/pull/122) contains the
+The initial [PR122](https://github.com/dosquartsdedocs/unaltraweb/pull/122) contained the
 post-release pin (`59bd62b`), first bound exporter (`cbf7260`) and resolver/check
-continuation. No merge or public release is part of this delivery.
+continuation. That initial delivery preceded the authorized integration and
+publication recorded below.
 
 ## Interface and contract
 
@@ -105,8 +106,8 @@ increment; recognizable QGIS captures get an explicit unsupported diagnostic.
 Interactive/arbitrary Liquid and undeclared outputs also fail closed. These
 limitations are recorded on #121 for producer/receiver coordination.
 
-The source version is 0.8.0 with publication status **pending**. The checkout
-launcher now selects published 0.7.4; observation of this conversation's existing
+At initial source delivery, version 0.8.0 had publication status **pending**. The checkout
+launcher then selected published 0.7.4; observation of this conversation's existing
 MCP still showed installed **0.7.3**, instance `ecac06618bd3436794e89c31746b8914`,
 bound to this checkout. It was not hot-reloaded or rebound. Hub admission belongs
 to gaContExt #52, and real-manual selection/author review remain separate.
@@ -123,7 +124,7 @@ with no manual checkout: all four conformance checks passed, receiver receipt
 `15b8561e1e55899b57d8e45b8d19b7a8eeaa669808cf729d29eac3589a3231fb`
 ([receiver return](https://github.com/dosquartsdedocs/unaltraweb/issues/121#issuecomment-6597815786)).
 
-The four new Web components are marked release-ready for the normal signed
+The four new Web components were marked release-ready for the normal signed
 candidate, receipt-only merge/tag and trusted publication workflow. Independent
 core/gem, workflow, PDF and QGIS selections retain their previously verified
 identities. This source readiness is not a claim of published bytes or admission.
@@ -132,3 +133,59 @@ GaContExt #52 specifically concerns admitting newer **Itemarium** native builds.
 The new Web tuple must also be delivered to the hub owner after publication;
 neither publication alone nor the existing consumer conformance receipt proves
 hub admission, selected-client activation or an export of a real teaching manual.
+
+## Published 0.8.0 and verified intake
+
+[Release v0.8.0](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.8.0)
+is published. PR122 supplies source `54afe7588c36e959a7eb75d5f52763a7456108d7`;
+receipt-only PR123 supplies tag target `f71aeea75e11f4c2b15df4451f47ddd8a161bd8b`.
+Annotated tag object: `eca74d75783bd6630a47376bd1a3076912a1a087`.
+Receipt SHA256: `a2bf883ea62a4f164c925fa477e756378d0590f8dc6bbcdc54c17b645a7896da`.
+
+- Wheel: `4dcec737596b4e4742e04b50a70b81d04ffadf993139e6ba1d1bce665ece4816`.
+- Gem: `bbc3dbbc106b69d7a677608c46bf1d4f64d7016a48b27301022ec71e5a378f79`.
+- Controller OCI: `ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08`.
+- Controller config ID: `sha256:e0502369c85c59f9e512fbd9fdb17dbc128845d057a1423375425e68ce2e79a2`.
+- Runtime OCI: `ghcr.io/dosquartsdedocs/unaltraweb@sha256:d58d8f68cf08a76e9b9f3ef238a0917b856cf7152aa5cc4a6f54ca109e1ac3fe`.
+- Runtime config ID: `sha256:c0ec72478618c3e7a9444cd7ae9120317a18757019b2fbf8f0438ca451695731`.
+
+Complete [release-handoff.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/release-handoff.json),
+SHA256 `7a7cab1d48e3302af5f21309e57b540d7ca81eb4d8c0f36c7a5da7099538a53a`,
+lists every asset, untagged Docker archive, independent worker and native profile.
+Core `9d97197` / gem 0.7.3, workflow `3332e0b`, PDF 0.7.1 and classic QGIS 0.6.1 are preserved.
+
+Signed candidate run `41641425949`, package preparation `41641430158`, Trusted
+Publishing `41687937608`, OCI promotion `41687938131` and tag CI `41687888720`
+passed. The exact controller's 40 package modules match the CI wheel. Its new
+code fingerprint is `sha256:a678d2b2649e3479d0049ca0ca8a500aba5bb3f0a59b070cd7aaf5c0c6b466d0`;
+the earlier development image/receipts above are retained as their own evidence.
+
+The exact installed release controller exported two new fixture packages:
+`9bc3b4506a3f04c66631e7bcc3617b558879af95ee29f6c3b8fead870826afa7` and
+`7225f7c00f0992c922048608b622eec9a9d6d4b6a1c18049b32c2b5ffba7eb40`.
+Itemarium 0.6.2 again passed all four checks on these exact bytes. Release assets
+`producer-acceptance.json` and `consumer-conformance.json` have SHA256
+`4a8ae9db55757b584b24b9b1602ffe94e566cd4531016a073c7afc31e78f4e48` and
+`af73eba0cee0c447072df269572c22164dd8aca2eb0ea73e2416170056cd4e63`.
+
+All 18 original assets were downloaded anonymously and hash/size checked,
+including both image archives; PyPI/RubyGems copies and OCI aliases matched.
+[verification.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/verification.json)
+has SHA256 `ec04ac1714a1b00c2f8e14f415e0fb0e21a195e42c5848ce53694ce0b85ed403`.
+The downloaded public wheel was installed in a fresh environment: actual MCP
+discovery reports 65 tools, its bound exporter produces a valid package, and
+Itemarium's independent check passes without importing it.
+[public-installation.json](https://github.com/dosquartsdedocs/unaltraweb/releases/download/v0.8.0/public-installation.json)
+has SHA256 `b94920fd618d50ba384207d3e2a126ccd4b1cf98b697760d4d27c09f6b80cf75`.
+
+Post-release verification of the updated checkout pin passes distribution/workflow
+checks, the public-image bootstrap check/smoke and the full local suite: 763 cases,
+736 passed and 27 skips in that prepared environment.
+
+The post-release checkout pin now selects the published 0.8.0 controller. The
+configured hub's immutable `cbb753e4…` controls still admit Web only through 0.7.4;
+this is an observed admission boundary, not a missing producer release. The full
+intake is [gaContExt #54](https://github.com/dosquartsdedocs/gacontext/issues/54),
+alongside Itemarium's separate #52. No hub registry, other client registration or
+real manual was changed here. Source selection, hub admission and live client
+activation remain distinct.

data/docs/agents/manual-context-fix-121.md

@@ -0,0 +1,130 @@
+# Minimal #121 producer repair: P1 + P2
+
+Coordination request:
+`gacontext-itemarium-readiness-20261104-unaltraweb-02290003fd784c20a1659f4f803839ef`.
+
+Authoritative workspace: `/home/benizar/git/unaltraweb`. Branch
+`fix/121-context-inputs-html` starts from the preserved review125 at
+`b67a51292f680d3bc0058b272c68116c3fd75bc4`; clean preflight was ELIGIBLE.
+The review branch and experimental116 at
+`6a8cd85ff75c8ad41dc67f8fb1c3c5a8f8919e53` remain intact. No other checkout,
+registry, real manual or teacher bank is modified by this unit.
+
+## Implemented repairs
+
+**P1:** `Snapshot.computation_input` validates declared check-only dependencies
+separately from public sources. Only native computation input/environment
+declarations use this path. Existing descriptor-relative no-follow reads,
+per-file/total budgets, complete native status checks and final input/inventory
+rechecks are reused. No rendering or native source execution is introduced.
+
+The private practice root stays forbidden to images/includes/outputs, even if a
+caller attempts to name it as the manual collection. Opaque inputs remain outside
+the archive; fingerprints and external retained receipts bind their exact bytes.
+The same role correction supports TIGIT's explicitly declared root environment
+files `Dockerfile.compute-python`, `Dockerfile.compute-r`,
+`requirements-compute.txt` and `requirements-compute.R`. This avoids merely moving
+the first private-data error to the next environment-file error.
+
+**P2:** HTML `alt`, `title` and `data-caption-source` values are restored before
+`figure()` stores metadata and computes the ID, just as Markdown attributes were.
+Tests assert exact text and identity stability when unrelated inline code is added.
+
+No general Liquid extension, SVG raster policy, QGIS provenance adapter, W1
+integration or Geo collector is included. Existing typed refusal envelopes and
+v1 schema remain unchanged.
+
+## Tests and actual producer/receiver execution
+
+- 30 targeted context cases, including private input success, no private payload
+  or path leakage, global checking for an unrelated selected chapter, missing/
+  changed data, root environment fingerprints, symlink/traversal/hidden-root
+  refusals, unchanged 10 MiB reader limit and private-collection refusal.
+- Full local suite during implementation: **771 cases, 743 passed, 28 skips**;
+  the final declaration-type regression is additionally covered in the 30-case
+  targeted pass. Final-head CI retains the repository-wide gate.
+- `distribution-check`, `workflow-check`, `make mcp-check`, `make mcp-smoke`: PASS.
+  Base runtime and PDF toolchain layers were cached; only MCP/package layers and
+  small metadata were rebuilt for the successive fixes.
+  Disk observation: 15 GiB before, 14 GiB after verification. No global cleanup.
+- The acceptance runner has an explicit `--private-inputs-html` fixture mode.
+  It uses synthetic native computation records (not a claim of computation
+  rendering), a private input sentinel and the formerly broken HTML caption.
+  The **real MCP exporter** creates both transport archives. Assertions inspect
+  their exact manifests/closure, restored attributes, absence of private bytes/
+  paths/tokens and create-only behavior. A real CLI selects one block as well.
+
+Installed candidate controller:
+`sha256:b5b6c1e7816623a63c3340b97195253ff612458cf4b96ed443fafad2a1369bac`.
+Producer version **0.8.1 candidate**, fingerprint
+`sha256:2f82f9adb62a7111229e270772f00c1276ec546e9e42e4ad54e32e86e2a8ebdf`.
+The isolated stdio containers have read-only rootfs, disabled network, no Docker
+socket, and only their synthetic manual mounted. Both close and are confirmed absent.
+
+Evidence below `tmp/context-p1p2-acceptance-qualified/`:
+
+| Artifact | SHA256 |
+| --- | --- |
+| `producer-receipt.json` | `a610e07bc6a369079406ea93edc02581b2ec6dcbe82506ad314ed0920fec46b6` |
+| `manual-fixture/tmp/manual-context/v1/manual-context.tar.gz` | `8a53b2721e24544ba45ee18b8535f298691cb857054cd7ed12189d610007c971` |
+| `manual-fixture/tmp/manual-context/v2/manual-context.tar.gz` | `971d22218e3b407825643f63e524c6438a378e6a90db624afa689e4b1d66a8b9` |
+
+Itemarium's independent source runner 0.6.2 (engine
+`1a8983100c4b0c72bac74912fdde7a4d8ad14ce9970e188f13aae611dbeee813`) consumes
+these exact exporter archives and passes all four checks: integrity/closure,
+isolated import, existing-bank preservation and backup/reopening. Receipt:
+`tmp/context-p1p2-conformance-qualified/receipt.json`, SHA256
+`1660f7c576aa52e6f9fbcb39ec7d15a3a6b3c56b3a8dd63b4e2d1017d24bd9b9`.
+The source-mode preliminary run remains separately retained under
+`tmp/context-p1p2-acceptance-01` / `tmp/context-p1p2-conformance-01`; it predates
+the 0.8.1 metadata and is not relabelled as installed-candidate proof. Intermediate
+`-081` and `-081-final` runs are also retained; the qualified run includes the
+HTML entity-decoding and typed-declaration corrections. Protected HTML entities
+are decoded once without double-decoding surrounding attribute text.
+
+## Reproduction and next intake
+
+From this checkout with a prepared Python environment and the candidate image:
+
+```bash
+python scripts/test_manual_context_export.py \
+  --output /absolute/unaltraweb/tmp/new-p1p2-acceptance \
+  --private-inputs-html --image <exact-prepared-controller-ID>
+```
+
+Feed its returned first/next paths and hashes directly to Itemarium's documented
+`manual_package_conformance.py`, with a fresh output below Web's `tmp/`. Never
+manufacture replacement archives. These tests qualify the implementation; they
+do not substitute for the real TIGIT owner's subsequent export and bank workflow.
+
+Source metadata proposes **0.8.1** for package/gem artifact/controller/runtime,
+with publication status `ready` after explicit closeout authorization. The existing public checkout pin stays on
+0.8.0 until a new immutable publication is verified. Independent selections:
+
+- Native Git core `9d97197dec5fc9346ab795191a3afd18884c27fb`, gem **0.7.3**.
+- Workflow `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+- PDF **0.7.1**, OCI `sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+- Classic QGIS **0.6.1**, descriptor and controller/engine IDs unchanged.
+
+Required next gates: review/integration, exact signed candidates and receipt-only
+publication, cold installed proof, then a new reviewed hub intake. The local image
+is not a published or admitted point. TIGIT keeps its current activated0.8.0
+selection until explicit adoption, and must report a real export's path/SHA/receipt
+or the next exact blocker. No real TIGIT package is claimed by this fixture proof.
+
+## Follow-up review: opaque YAML dependencies
+
+PR126 discussion `4471006805` was reproduced on `b582c998`: a declared
+`_practices/course/data/parameters.yml` with valid YAML anchors and a current
+synthetic native computation receipt failed in `Snapshot.copy`. Check-only
+dependencies now pass `opaque=True`; Reader confinement, budgets, hashes and
+final source checks remain shared. Configuration reads still scan YAML even
+when a previous opaque read has already staged the file.
+
+The regression exports the anchored dataset without transporting its private
+bytes/path, then rejects its changed fingerprint. A separate regression refuses
+anchors on a configuration read after an opaque copy and in `_config.yml`.
+The installed-export harness also includes anchored YAML alongside the CSV
+input. Full local suite: 774 tests, OK (28 skipped). Earlier candidate hashes
+above remain historical; the changed source requires fresh installed-candidate
+and receiver evidence before publication.

data/docs/agents/manual-context-pilot-review-121.md

@@ -0,0 +1,277 @@
+# #121 — review after real-manual pilots, 2026-11-04
+
+## Findings and implementation order
+
+1. **P1, producer defect:** declared computation inputs are incorrectly subjected
+   to the public-content root allowlist. This is the first reported TIGIT blocker
+   and is reproduced against the published 0.8.0 image, independently of missing
+   data, stale output, receiver behavior or an old client connection.
+2. **P2, producer defect:** HTML image metadata containing inline code retains
+   internal protection tokens in the manifest. This was found by the review's
+   synthetic component probe; it is not claimed as a reported TIGIT error.
+3. **Coordinated compatibility extension:** SVG embedded rasters are refused by
+   both released Web 0.8.0 and Itemarium 0.6.2. Widening Web alone cannot deliver
+   a consumable package. Agree a bounded profile/version and update both owners.
+4. **Producer provenance extension:** recognizable QGIS capture provenance has
+   no context exporter adapter. This is distinct from SVG raster compatibility;
+   even a standalone vector SVG can hit this producer gate.
+
+The immediate useful Web increment is **1 + 2**, with the unchanged v1 transport
+and an explicit new release/adoption. Then the TIGIT owner reruns the selected
+chapter. There is no evidence yet that general Liquid execution or QGIS/raster
+support is necessary for that particular chapter to pass its next gate.
+
+This is a review with executable reproductions, not a runtime repair or a new
+release. Production modules, schema and pins remain unchanged. The experimental
+#116 checkpoint remains `6a8cd85ff75c8ad41dc67f8fb1c3c5a8f8919e53` on
+`feat/116-common-practice-sdk`; none of it is used here.
+
+## State: publication, admission and the actual caller
+
+- Web 0.8.0 is published; artifact source
+  `54afe7588c36e959a7eb75d5f52763a7456108d7`, controller config ID
+  `sha256:e0502369c85c59f9e512fbd9fdb17dbc128845d057a1423375425e68ce2e79a2`,
+  OCI digest `sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08`.
+- [gaContExt PR55](https://github.com/dosquartsdedocs/gacontext/pull/55) is integrated
+  at `ccbe1610f975faee913044c47b567cfe5b856cc0`. Configured controls are
+  `c6b5ab73abc399d47489c199e9b91628254b84868674712a21acf0db42e9d768`.
+  Web 0.8.0 and Itemarium 0.6.2 are prepared/enrolled. Managed export/import,
+  version preservation and backup/reopening pass. See the
+  [hub return](https://github.com/dosquartsdedocs/gacontext/issues/54#issuecomment-6615276920).
+- The final fresh readonly TIGIT OpenCode status confirms **revision 5 / Web
+  0.8.0**, with matching configuration, deployment `272e7dce…` and the enrolled
+  controller above. Its older live connection `4ac20e8829224276a8765beefc71b559`
+  still loads **0.7.4**. The initial observation in this review returned the
+  preceding revision-4 state; it is superseded by this reobservation and the
+  [TIGIT #27 return](https://github.com/geourv/tigit/issues/27#issuecomment-6625078407).
+- TIGIT's owner explicitly activated the new point and invoked a bounded managed
+  connection with loaded/current 0.8.0, no drift, correct binding and 65 tools.
+  Its complete-Catalan export hits the same private-input error, creates no
+  package/receipt, then drains/exits and leaves its exact controller absent.
+  Restarting the older connection does not repair this confirmed 0.8.0 defect.
+- TIGIT's local `_config.yml` already contains `unaltraweb.manual.id: tigit`.
+  The old missing-ID diagnosis is obsolete for that inspected working copy.
+- Itemarium's 2026-11-04 report observes native **0.6.2 / 63 tools**, unchanged
+  frozen bytes, and a separate Web 0.7.4 connection bound to Itemarium. Its actual
+  real-manual CLI probe explicitly uses the published 0.8.0 image in a readonly,
+  network-disabled mount. It creates no real manual package.
+
+Owner input: `itemarium/docs/handoffs/2026-11-04-manual-adoption-readiness.ca.md`,
+SHA256 `1a9438e6c2f412200006f9769069e98fa42d76c101a3556b154dbc6ca6d4195c`;
+retained pilot `tmp/manual-readiness-20261104/receipt.json`, SHA256
+`551c372cfd0576d1ee71cbb2be0b6f614d4fc783ecc474c06c783822f20d24d2`.
+These were inspected read-only while the receiver owner retained its working
+changes. No teacher-bank contents were needed for this review.
+
+## P1 — separate check-only dependencies from transported public content
+
+The owner reports identical exit-1 failures for the whole manual and
+`--chapter manual-territorial-indicators`:
+
+```text
+UW-MANUAL-CONTEXT
+Resource is outside the public manual source roots:
+_practices/tigit-projecte-territorial/data/processed/tarragones-boundaries-icgc-20260120.gpkg
+```
+
+The declaration is present in
+`assets/quarto/cartographic-language/minimum-mapping-unit-tarragones.qmd`, lines
+13–19. It is a computation input; the declared published output is an SVG under
+`assets/img/`. The call chain is
+`Sources._computations → dependency → Snapshot.public`, at
+[`manual_context_sources.py:40–47`](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.8.0/src/unaltraweb_mcp/manual_context_sources.py#L40-L47).
+`Snapshot.public` is appropriate for content entering the transport but rejects
+this check-only dependency before native freshness verification.
+The TIGIT owner also confirms an existing regular GPKG of **598016 bytes**, below
+the exporter's current 10 MiB per-file reader limit. The observed blocker is its
+root/role policy, not that size limit.
+
+Published-image reproductions:
+
+- `public-input`: a synthetic declared input under `assets/data/` passes the
+  native computation status and actual export. The input itself is absent from
+  the transport; only the effective section and SVG are declared.
+- `private-input`: the same opaque bytes and valid synthetic native record under
+  `_practices/fixture/data/` pass native `status` (`current_count:1`, `ok:true`),
+  then fail in the exporter with the reported root error. The file exists; no
+  missing-file or GIS-format failure is inferred. No computation is executed.
+- `private-input-other-chapter`: the same refusal occurs when selecting a chapter
+  that does not reference the computation. This confirms the existing global
+  completeness gate, rather than an ineffective chapter selector.
+- `changed-public-input` gives `source_or_environment_changed`; `missing-figure`
+  gives `Missing editorial input`. These are distinct local-source conditions.
+- `private-image` is correctly refused. Adding `_practices` indiscriminately to
+  `public_roots` would weaken this required transport boundary.
+
+### Concrete repair and tests
+
+Introduce a separate bounded dependency-read/snapshot path for **explicit native
+input declarations**. Keep public-source/image selection on `Snapshot.public`.
+Use the existing descriptor-relative reader, literal project-relative validation,
+no-follow rules and before/after rechecks. Permit verification of the declared
+private input without discovering/copying an entire private repository or sending
+its content. Keep native global completeness and fingerprint checks intact.
+
+The two roles must remain separate throughout the snapshot, input fingerprint,
+resolution evidence and final transport inventory. Required regression cases:
+
+1. An unchanged declared `_practices/...` input passes native checking/export;
+   only selected sections and effective figures appear in the tar and `files`.
+2. Sentinel private data, private paths and executable source bytes do not leak
+   into transported Markdown/figures/manifest. A private path may remain in the
+   producer's external retained check receipt, not the content package.
+3. Changed/missing inputs, modified outputs and stale records still fail;
+   chapter selection cannot bypass the global check.
+4. Traversal, symlinks, undeclared/private image or include references and source
+   changes during export still fail before a sealed delivery.
+5. Dependency byte budgets remain explicit and bounded. If a real declared input
+   exceeds the current reader budget, assess a bounded streaming snapshot/hash
+   path separately; do not silently increase the image/text transport limits.
+
+No v1 schema extension is needed for this role correction. Moving the GPKG into
+public assets, removing its declaration, skipping global checks or hand-authoring
+a package in Itemarium are not a verification of the repair.
+
+## P2 — restore HTML figure metadata before registration
+
+Input used in `html-caption-code`:
+
+```html
+<img src="assets/img/plain.svg" alt="Alt `code`" title="Caption `literal`">
+```
+
+The real published exporter succeeds but records:
+
+```json
+{"alt":"Alt UNALTRAWEBEXPORTPROTECTED0TOKEN",
+ "caption":"Caption UNALTRAWEBEXPORTPROTECTED1TOKEN"}
+```
+
+[`Projection.text`](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.8.0/src/unaltraweb_mcp/manual_context.py#L261-L326)
+restores protected Markdown-image attributes before `figure()`, but
+[`html_images`](https://github.com/dosquartsdedocs/unaltraweb/blob/v0.8.0/src/unaltraweb_mcp/manual_context.py#L328-L351)
+registers HTML attributes while they still contain placeholders. The final text
+restoration does not repair the previously registered manifest or figure ID.
+
+The actual produced package SHA is
+`53d065605af60cd90f73553b3c7004a52c6fa6e74ec4a0f88336f879f161296a`.
+Itemarium's independent package checker accepts it: byte integrity is correct,
+but `caption_preserved:false` exposes the semantic error. This is a producer
+fidelity defect, not a malformed source or a receiver checksum failure.
+
+Restore `alt`, caption/title and credits before calculating the registration ID
+and storing metadata, or replace placeholder-based attribute handling with a
+token-aware path. Add assertions for exact HTML/Markdown metadata parity, quoted
+and escaped attributes, inline code in credits, absence of internal markers and
+stable figure identity when unrelated code appears earlier in the text.
+
+## Components and Liquid: supported subset versus missing functionality
+
+The `components` case combines a literal include, definitions, a localized
+callout, a citation, table, subfigures and `site.baseurl`. Its actual archive is
+accepted independently by Itemarium. These are the same principal source forms
+observed in TIGIT chapter 2; this does not prove the complete real chapter exports.
+
+`{{ page.title }}` and a parameterized include are refused with the documented
+Liquid/include diagnostics. No real pilot return inspected here reaches one of
+those errors. They are explicit unsupported producer forms, not evidence that
+all Liquid/components fail or that an old client explains the private-input error.
+
+If the subsequent pilot needs another form, record its exact source fragment and
+add a deliberately bounded resolver case with source/resource closure and literal
+code protection. Do not replace export with unrestricted Jekyll/Liquid execution.
+Diagnostics should identify the rejected form and source location distinctly
+from a missing include or a stale resource.
+
+## SVG with raster: coordinate producer and receiver policy
+
+`embedded-raster` contains a valid, small PNG embedded as
+`<image href="data:image/png;base64,...">` in a standalone SVG. Web rejects it at
+`manual_context_media.validate_image`; Itemarium's existing `app.media.read_image`
+independently rejects the **same image bytes**, before any package import.
+The external-URL raster control is also refused. No alternative transport archive
+is fabricated for these checks; they are image-member validator probes only.
+
+Required coordinated work, if the pilot needs these effective figures:
+
+- Agree the compatibility profile/version rather than silently widening v1 or
+  adding unrecognized manifest fields. The admitted Itemarium 0.6.2 point rejects
+  the current payload even if only Web's allowlist is changed.
+- Permit only agreed raster MIME types, verified base64/decoded bytes, dimensions,
+  pixel/byte/element budgets and safe image decoding. Preserve XML/DTD/entity,
+  active-content and external-network/resource refusals.
+- Preserve the selected edited SVG and bind the delivered effective bytes to new
+  resolution evidence. Never substitute the original screenshot or rasterize as
+  an implicit export side effect.
+- Test valid embedded PNG/JPEG, oversized/malformed data, nested SVG data URLs,
+  external href/CSS and actual exported-package checking/import/backup in the new
+  receiver. New installed bytes need their own release/admission evidence.
+
+## QGIS provenance: a separate gate
+
+`qgis-vector` has only safe vector geometry/text plus synthetic QGIS metadata:
+Itemarium's image validator accepts the SVG, but Web refuses missing QGIS capture
+provenance. Thus adding raster support alone does not solve this gate.
+
+`qgis-untyped` supplies ordinary static vector bytes with a QGIS-related alt label.
+It exports as `resolution.kind: static`. That is not proof of a fresh QGIS output:
+the current byte-token/path heuristic is a refusal hint, not a provenance adapter.
+Removing metadata to force static treatment is not an acceptable adoption route.
+
+Implement an explicit mapping from a declared QGIS output to an independently
+verified producer bundle/receipt, selected original/edited output and complete
+required resource closure. Verify hashes, native producer/profile identity and
+freshness; bind new evidence to the exact effective bytes. Reject missing/tampered
+receipts, stale edits, incomplete resources and mismatched outputs. Exercise native
+QGIS verification through an agreed existing interface; do not embed the private
+QGIS implementation in Web or trust a caller's success boolean.
+
+The schema already names `qgis-capture`, but no record dispatch in 0.8.0 produces
+that verified kind. Pin/qualify the actual classic capture profile separately;
+this review does not adopt the #116 shared-job checkpoint or a different QGIS
+practice tuple. After provenance works, the effective SVG must still satisfy the
+negotiated receiver image policy.
+
+## Reproduction and evidence
+
+Versioned runner: `scripts/review_manual_context_pilots.py`. It requires the two
+already-prepared published controller IDs (0.8.0 and 0.7.4), never pulls, and uses
+network-disabled/read-only-root containers with no Docker socket and only new
+synthetic fixture inputs. The 0.7.4 control rejects the unknown CLI command with
+exit 2; this is distinct from the published 0.8.0 content error (exit 1).
+
+```bash
+python scripts/review_manual_context_pilots.py \
+  --output /absolute/unaltraweb/tmp/context-pilot-review-new \
+  --receiver-python /absolute/prepared-python/bin/python \
+  --receiver-source /home/benizar/git/itemarium/tools/itemarium
+```
+
+The receiver flags are paired and optional. The receiver source is read-only,
+bytecode writes are disabled, and its before/after engine fingerprint is checked.
+Only archives actually produced by the published exporter reach `check_package`.
+There is no app/bank creation or question generation in this review.
+
+Completed run: `tmp/manual-context-pilot-review-20261104-02/`:
+
+- 16 producer scenarios, five actual archives independently accepted by the
+  receiver; expected refusals remain failures in the retained domain responses.
+- Producer identity `sha256:a678d2b2649e3479d0049ca0ca8a500aba5bb3f0a59b070cd7aaf5c0c6b466d0`.
+- `producer-review.json` SHA256
+  `3a33b4b844bbc6e41419f420146d45e96b963bede0f04ae1e690c1a09dc25d69`.
+- `receiver-review.json` SHA256
+  `2c6944d9778e317dda5c0f6dfaf74cda5d7a339e7ad61dfb20f3012df071f521`.
+- Receiver source checker: 0.6.2, engine SHA256
+  `1a8983100c4b0c72bac74912fdde7a4d8ad14ce9970e188f13aae611dbeee813`.
+- Original fixture sources remain unchanged during export, and exact review
+  container absence is checked with a responsive Docker daemon.
+- The initial `-01` attempt failed in the review harness's root-mounted script
+  path calculation before exporter execution. It is retained, corrected in the
+  harness and not misclassified as a product failure.
+- Full existing suite: 763 cases, 736 passed, 27 skips; `git diff --check` passes.
+
+No live consumer activation, real-manual export, publication or runtime/schema
+patch is performed here. TIGIT owns its local sources/adoption and the next real
+chapter export; Web owns the two identified producer repairs and coordinated
+format/provenance extensions; Itemarium owns receiver changes and eventual
+explicit import with bank preservation.

data/docs/agents/mcp-contract.md

@@ -38,10 +38,11 @@ it to an image ID before execution. The source checkout's digest pin is separate
 it advances only after a new receipt exists. Explicit `--image` (or the console
 adapter's `UNALTRAWEB_MCP_IMAGE`) permits a reviewed immutable selection.
 
-The post-release checkout pin selects published 0.7.4 MCP digest
-`sha256:10bcaf1411f27a518969283a77e23dcc99119014b216270b3089ba85ba0b6c7e`.
-The [0.7.4 delivery report](scaffold-closeout-118.md) records the coherent independent
-core/gem tuple, reviewed scaffold migration and verified publication.
+The post-release checkout pin selects published 0.8.0 MCP digest
+`sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08`.
+The [0.8.0 delivery report](manual-context-121.md) records the verified portable
+manual exporter, public artifact tuple and independent Itemarium conformance.
+The coherent core/gem tuple and reviewed scaffold migration from 0.7.4 remain.
 Existing processes keep their running image until clients reconnect. Site build
 defaults and customized Makefiles remain separate, explicitly reviewed selections.
 

data/scripts/review_manual_context_pilots.py

@@ -0,0 +1,287 @@
+"""Opt-in, version-bound #121 review against the published 0.8.0 controller.
+
+Creates synthetic sources, invokes the REAL installed CLI without network/socket,
+and retains successes AND expected refusals. It does not repair the exporter,
+render figures, manufacture transport archives, or mount a teaching manual.
+Native computation locks below are explicitly synthetic check fixtures, not
+evidence that R/Python rendering took place. Itemarium checking is optional and
+uses its read-only source tree with a separately prepared Python interpreter.
+"""
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+import uuid
+
+ROOT = Path(__file__).resolve().parent.parent
+IMAGE = "sha256:e0502369c85c59f9e512fbd9fdb17dbc128845d057a1423375425e68ce2e79a2"
+OLD_IMAGE = "sha256:ea14b1224382e47031b979d294f970b66773155584ac8f9eb94a33dc6421b0c9"
+SOURCE = "54afe7588c36e959a7eb75d5f52763a7456108d7"
+PRODUCER = "sha256:a678d2b2649e3479d0049ca0ca8a500aba5bb3f0a59b070cd7aaf5c0c6b466d0"
+SVG = '<svg xmlns="http://www.w3.org/2000/svg" width="30" height="20"><rect width="30" height="20" fill="white"/><text x="1" y="12">Fixture</text></svg>'
+
+
+def sha(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def save(path, value):
+    with path.open("x", encoding="utf-8") as stream:
+        json.dump(value, stream, indent=2, sort_keys=True, ensure_ascii=False)
+        stream.write("\n")
+
+
+def write(root, name, data):
+    path = root / name
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("xb") as stream:
+        stream.write(data.encode() if isinstance(data, str) else data)
+
+
+def command(argv, *, cwd=None, expected=0, env=None):
+    result = subprocess.run(argv, cwd=cwd, env=env, capture_output=True, text=True, timeout=180)
+    if expected is not None and result.returncode != expected:
+        raise RuntimeError(f"Command failed: {argv}: {result.returncode}\n{result.stderr[-4000:]}")
+    return result
+
+
+def cases(root):
+    from PIL import Image
+    import yaml
+    png = io.BytesIO()
+    Image.new("RGB", (2, 2), "navy").save(png, format="PNG")
+    encoded = base64.b64encode(png.getvalue()).decode()
+    rows = [
+        {"id": "baseline", "body": 'Text.\n\n![Alt](assets/img/plain.svg "Caption")\n', "ok": True},
+        {"id": "missing-id", "no_id": True, "error": "unaltraweb.manual.id"},
+        {"id": "missing-figure", "body": '![Alt](assets/img/missing.svg "Caption")\n', "error": "Missing editorial input"},
+        {"id": "public-input", "compute": "assets/data/input.gpkg", "ok": True},
+        {"id": "private-input", "compute": "_practices/fixture/data/input.gpkg", "error": "outside the public manual source roots"},
+        {"id": "private-input-other-chapter", "compute": "_practices/fixture/data/input.gpkg", "unreferenced": True,
+         "chapter": "first", "error": "outside the public manual source roots"},
+        {"id": "changed-public-input", "compute": "assets/data/input.gpkg", "changed_input": True,
+         "error": "source_or_environment_changed"},
+        {"id": "private-image", "body": '![Alt](_practices/fixture/private.png "Private")\n',
+         "extra": {"_practices/fixture/private.png": png.getvalue()}, "error": "outside the public manual source roots"},
+        {"id": "components", "body": '''{% include note.md %}
+
+{% cite fixture %}
+
+::: table "Table caption"
+| A | B |
+| --- | --- |
+| 1 | 2 |
+:::
+
+::: subfigures a+b "Group caption"
+![A]({{ site.baseurl }}/assets/img/plain.svg "Panel A")
+![B](assets/img/plain.svg "Panel B")
+:::
+''', "extra": {"_includes/note.md": "Term\n: Exact definition.\n\n>>>> Warning text.\n",
+               "_bibliography/manual.bib": '@book{fixture, title={Fixture reference}, author={Author, A}, year={2026}}'}, "ok": True},
+        {"id": "liquid-expression", "body": "Title: {{ page.title }}\n", "error": "unresolved Liquid/include"},
+        {"id": "include-parameters", "body": '{% include note.md label="Example" %}\n',
+         "extra": {"_includes/note.md": "A note."}, "error": "without parameters"},
+        {"id": "html-caption-code", "body": '<img src="assets/img/plain.svg" alt="Alt `code`" title="Caption `literal`">\n',
+         "ok": True, "expected_caption": "Caption `literal`"},
+        {"id": "embedded-raster", "body": '![Raster](assets/img/embedded.svg "Raster")\n',
+         "image": "assets/img/embedded.svg", "extra": {"assets/img/embedded.svg": '<svg xmlns="http://www.w3.org/2000/svg"><image href="data:image/png;base64,' + encoded + '" width="2" height="2"/></svg>'},
+         "error": "cannot receive SVG <image>"},
+        {"id": "external-raster", "body": '![Raster](assets/img/external.svg "Raster")\n',
+         "image": "assets/img/external.svg", "extra": {"assets/img/external.svg": '<svg xmlns="http://www.w3.org/2000/svg"><image href="https://example.invalid/image.png"/></svg>'},
+         "error": "cannot receive SVG <image>"},
+        {"id": "qgis-vector", "body": '![Map](assets/img/map.svg "Map")\n', "image": "assets/img/map.svg",
+         "extra": {"assets/img/map.svg": SVG.replace("<rect", '<metadata>{"producer":"unaltracaptura-qgis"}</metadata><rect')},
+         "error": "QGIS capture handoff is not supported"},
+        {"id": "qgis-untyped", "body": '![QGIS result](assets/img/map.svg "Authored static bytes")\n',
+         "image": "assets/img/map.svg", "extra": {"assets/img/map.svg": SVG}, "ok": True},
+    ]
+    for row in rows:
+        case = root / row["id"]
+        case.mkdir()
+        config = {"theme": "unaltraweb", "title": "Synthetic review", "default_lang": "ca", "languages": ["ca"],
+                  "exclude": ["tmp/", "_practices/"], "unaltraweb": {"site_profile": "unaltremanual", "manual": {"id": "review-121"}}}
+        if row.get("no_id"):
+            del config["unaltraweb"]["manual"]["id"]
+        write(case, "_config.yml", yaml.safe_dump(config))
+        write(case, ".gitignore", "/tmp/\n")
+        write(case, "assets/img/plain.svg", SVG)
+        body = row.get("body", 'Text.\n\n![Alt](assets/img/plain.svg "Caption")\n')
+        if row.get("compute"):
+            write(case, ".unaltraweb/computations.yml", "version: 1\nsource_roots: [assets/compute]\n")
+            write(case, row["compute"], b"OPAQUE SYNTHETIC FINGERPRINT INPUT; NOT A GIS VALIDITY TEST\n")
+            front = {"title": "Computed fixture", "lang": "ca", "ref": "computed-fixture", "unaltraweb_compute": {
+                "engine": "python", "mode": "figure", "inputs": [row["compute"]], "outputs": ["assets/img/result.svg"]}}
+            write(case, "assets/compute/figure.qmd", "---\n" + yaml.safe_dump(front) + "---\nSynthetic source; no computation execution.\n")
+            write(case, "assets/img/result.svg", SVG)
+            if not row.get("unreferenced"):
+                body = '![Computed](assets/compute/figure.qmd "Computed fixture")\n'
+        write(case, "_chapters/ca/first.md", "---\ntitle: First\nlang: ca\nref: first\n---\n" + body)
+        for name, data in row.pop("extra", {}).items():
+            write(case, name, data)
+        command(["git", "init", "-b", "fixture"], cwd=case)
+        paths = [p.relative_to(case).as_posix() for p in case.rglob("*") if p.is_file() and ".git" not in p.parts]
+        command(["git", "add", "--", *paths], cwd=case)
+        command(["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "commit", "-m", "Synthetic review sources"], cwd=case)
+    save(root / "cases.json", rows)
+
+
+def worker(root):
+    """Executed in the exact published image. No exporter function is replaced."""
+    from unaltraweb_mcp import __version__
+    from unaltraweb_mcp.manual_context import producer_identity
+    assert root == Path("/cases") and os.environ.get("UW_REVIEW_WORKER") == "1"
+    identity = producer_identity(Path("/opt/unaltraweb"))
+    assert __version__ == "0.8.0" and identity["revision"] == PRODUCER
+    rows = json.loads((root / "cases.json").read_text())
+    results = []
+    for row in rows:
+        case = root / row["id"]
+        native_status = None
+        if row.get("compute"):
+            spec = importlib.util.spec_from_file_location("review_native_compute", "/opt/unaltraweb/scripts/computations/render.py")
+            native = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(native)
+            config, config_path = native.load_config(case)
+            record, = native.discover_sources(case, config)
+            fingerprint, dependencies, image = native.fingerprint(case, config, config_path, record)
+            saved = {"fingerprint": fingerprint, "dependencies": dependencies, "image": image,
+                     "image_identity": native.inspect_image(image["image"]),
+                     "outputs": [{"path": p, **native.file_signature(case / p)} for p in record["output_paths"]]}
+            save(case / ".unaltraweb/computations.lock.json", {"version": 1, "records": {record["source_path"]: saved}})
+            native_status = native.status(case)
+            assert native_status["ok"], native_status
+            if row.get("changed_input"):
+                with (case / row["compute"]).open("ab") as stream:
+                    stream.write(b"CHANGED INPUT\n")
+        before = {p.relative_to(case).as_posix(): sha(p.read_bytes()) for p in case.rglob("*")
+                  if p.is_file() and ".git" not in p.parts and "tmp" not in p.relative_to(case).parts}
+        argv = [sys.executable, "-I", "-B", "-m", "unaltraweb_mcp.cli", "--project", str(case), "mcp",
+                "manual-context-export", "--name", "review", "--language", "ca"]
+        if row.get("chapter"):
+            argv += ["--chapter", row["chapter"]]
+        ran = command(argv, expected=None)
+        result = json.loads(ran.stdout)
+        expected = (ran.returncode == 0 and result.get("ok") is True) if row.get("ok") else (
+            ran.returncode == 1 and result.get("ok") is False and row["error"] in result.get("error", ""))
+        item = {"id": row["id"], "expected_behavior_observed": expected, "command": argv, "exit_code": ran.returncode,
+                "result": result, "stderr": ran.stderr, "source_hashes": before,
+                "synthetic_native_status": native_status, "renderer_executed": False}
+        archive = case / "tmp/manual-context/review/manual-context.tar.gz"
+        item["archive_created"] = archive.exists()
+        if result.get("ok"):
+            assert archive.is_file() and sha(archive.read_bytes()) == result["sha256"]
+            with tarfile.open(archive) as content:
+                members = {m.name: content.extractfile(m).read() for m in content.getmembers()}
+            manifest = json.loads(members.pop("manual-context.json"))
+            assert set(manifest["files"]) == set(members)
+            assert all(entry["sha256"] == sha(members[p]) and entry["size_bytes"] == len(members[p]) for p, entry in manifest["files"].items())
+            item["manifest"] = manifest
+            if row.get("expected_caption"):
+                item["expected_caption"] = row["expected_caption"]
+                item["caption_preserved"] = manifest["figures"][0]["caption"] == row["expected_caption"]
+        else:
+            assert not archive.exists(), "A refusal left a transport package"
+        assert all(sha((case / p).read_bytes()) == value for p, value in before.items())
+        save(root / (row["id"] + ".result.json"), item)
+        results.append(item)
+    save(root / "producer-review.json", {"ok": all(row["expected_behavior_observed"] for row in results),
+        "purpose": "Version-bound baseline review, not acceptance of known defects", "producer": identity,
+        "synthetic_only": True, "real_manual_mounted": False, "renderer_executed": False, "cases": results})
+
+
+RECEIVER = '''import json, sys
+from pathlib import Path
+import itemarium
+from itemarium.app.media import read_image
+from itemarium.app.manual_package import check_package
+from itemarium.runtime_identity import source_sha256
+root = Path(sys.argv[1]); engine = Path(itemarium.__file__).parent
+before = source_sha256(engine); results = []
+for case in json.loads((root/'cases.json').read_text()):
+    result = json.loads((root/(case['id']+'.result.json')).read_text())['result']
+    row = {'id':case['id']}
+    if result.get('ok'):
+        row['package_check'] = check_package(package_path=root/case['id']/result['path'], sha256=result['sha256'])
+    if case.get('image'):
+        try:
+            read_image(root/case['id']/case['image']); row['image_check'] = {'ok':True}
+        except ValueError as error:
+            row['image_check'] = {'ok':False, 'error':str(error)}
+    results.append(row)
+assert source_sha256(engine) == before
+report = {'engine_version':itemarium.__version__, 'engine_source_sha256':before, 'cases':results,
+          'imports_performed':False, 'manufacturer_of_alternate_packages':False,
+          'image_checks_are_member_validation_only':True}
+with (root/'receiver-review.json').open('x') as output:
+    json.dump(report, output, sort_keys=True, indent=2); output.write('\\n')
+'''
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--receiver-python", type=Path)
+    parser.add_argument("--receiver-source", type=Path)
+    parser.add_argument("--worker", type=Path, help=argparse.SUPPRESS)
+    args = parser.parse_args()
+    if args.worker:
+        worker(args.worker)
+        return
+    if not args.output or bool(args.receiver_python) != bool(args.receiver_source):
+        parser.error("Supply --output; pair --receiver-python with --receiver-source")
+    if not (ROOT / "mcp-factory.yml").is_file():
+        parser.error("Run this review harness from the unaltraweb source checkout")
+    output = args.output.resolve()
+    if output != args.output or not output.is_relative_to(ROOT / "tmp") or not output.parent.is_dir():
+        parser.error("Use a new absolute output below this checkout's tmp, with an existing parent")
+    observed, = json.loads(command(["docker", "image", "inspect", IMAGE]).stdout)
+    assert observed["Id"] == IMAGE and observed["Config"]["Labels"]["org.opencontainers.image.revision"] == SOURCE
+    output.mkdir(mode=0o700)
+    cases(output)
+    name = "unaltraweb-review121-" + uuid.uuid4().hex
+    argv = ["docker", "run", "--rm", "--pull", "never", "--name", name, "--network", "none", "--read-only",
+            "--user", f"{os.getuid()}:{os.getgid()}", "--cpus", "2", "--memory", "2g", "--pids-limit", "256",
+            "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--tmpfs", "/tmp:rw,nosuid,nodev,size=268435456",
+            "-e", "HOME=/tmp", "-e", "PYTHONDONTWRITEBYTECODE=1", "-e", "UW_REVIEW_WORKER=1",
+            "--mount", f"type=bind,source={output},target=/cases",
+            "--mount", f"type=bind,source={Path(__file__).resolve()},target=/review.py,readonly",
+            "--entrypoint", "python3", IMAGE, "-I", "-B", "/review.py", "--worker", "/cases"]
+    for path in (output, Path(__file__).resolve()):
+        if any(c in str(path) for c in ",\r\n"):
+            raise ValueError("Review mount path needs a simple literal spelling")
+    ran = command(argv, expected=None)
+    save(output / "execution.json", {"command": argv, "exit_code": ran.returncode, "stdout": ran.stdout, "stderr": ran.stderr})
+    command(["docker", "info", "--format", "{{.ID}}"])
+    absent = command(["docker", "container", "inspect", name], expected=None)
+    assert absent.returncode == 1 and "No such" in absent.stderr, "Exact review container absence not established"
+    if ran.returncode:
+        raise RuntimeError(ran.stderr[-6000:])
+    report = json.loads((output / "producer-review.json").read_text())
+    assert report["ok"], "A scenario differed from the recorded 0.8.0 behavior; inspect retained results"
+    old, = json.loads(command(["docker", "image", "inspect", OLD_IMAGE]).stdout)
+    assert old["Id"] == OLD_IMAGE
+    old_result = command(["docker", "run", "--rm", "--pull", "never", "--network", "none", "--read-only",
+                          "--entrypoint", "unaltraweb-mcp", OLD_IMAGE, "mcp", "manual-context-export", "--name", "probe"], expected=None)
+    assert old_result.returncode == 2 and "invalid choice" in old_result.stderr
+    save(output / "old-runtime.json", {"image_id": OLD_IMAGE, "exit_code": old_result.returncode, "stderr": old_result.stderr})
+    if args.receiver_python:
+        environment = {**os.environ, "PYTHONPATH": str(args.receiver_source.resolve()), "PYTHONDONTWRITEBYTECODE": "1"}
+        # Keep a venv interpreter's spelling: resolving its python symlink would
+        # silently select the system interpreter and lose the prepared dependencies.
+        command([str(args.receiver_python.absolute()), "-B", "-c", RECEIVER, str(output)], env=environment)
+    print(json.dumps({"ok": True, "output": str(output), "cases": len(report["cases"]),
+                      "receipt_sha256": sha((output / "producer-review.json").read_bytes()), "exact_container_absent": True}, indent=2))
+
+
+if __name__ == "__main__":
+    main()

data/scripts/test_manual_context_export.py

@@ -14,11 +14,12 @@ from pathlib import Path
 import sys
 import subprocess
 import uuid
+import tarfile
 
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / "src"))
 sys.path.insert(0, str(ROOT / "test"))
-from test_manual_context import fixture, write, commit  # noqa: E402
+from test_manual_context import fixture, write, commit, computation_fixture  # noqa: E402
 
 
 def save(path, value):
@@ -27,6 +28,18 @@ def save(path, value):
         stream.write("\n")
 
 
+def verify_private_inputs_html(project, result):
+    with tarfile.open(project / result["path"]) as archive:
+        files = {entry.name: archive.extractfile(entry).read() for entry in archive.getmembers()}
+    manifest = json.loads(files["manual-context.json"])
+    assert manifest["figures"][0]["caption"] == "Caption `literal`"
+    assert manifest["figures"][0]["alt"] == "Alt `code`"
+    assert set(files) == {"manual-context.json", *manifest["files"]}
+    data = b"".join(files.values())
+    assert b"PRIVATE_CHECK_ONLY_SENTINEL" not in data and b"_practices/" not in data
+    assert b"UNALTRAWEBEXPORTPROTECTED" not in data
+
+
 async def export(project, name, image=""):
     from mcp import ClientSession, StdioServerParameters
     from mcp.client.stdio import stdio_client
@@ -78,6 +91,7 @@ def main():
     parser.add_argument("--output", type=Path, required=True)
     parser.add_argument("--single", action="store_true")
     parser.add_argument("--image", default="", help="Already-built MCP image; pull-never, network-disabled fixture stdio")
+    parser.add_argument("--private-inputs-html", action="store_true", help="Exercise P1/P2 with explicitly synthetic native computation records")
     args = parser.parse_args()
     output = args.output.resolve()
     if output != args.output or not output.is_relative_to(ROOT / "tmp") or not output.parent.is_dir():
@@ -86,7 +100,20 @@ def main():
     project = output / "manual-fixture"
     project.mkdir()
     fixture(project)
+    if args.private_inputs_html:
+        write(project, "_practices/fixture/data/input.csv", "PRIVATE_CHECK_ONLY_SENTINEL,1\n")
+        write(project, "_practices/fixture/data/parameters.yml", "defaults: &defaults {value: PRIVATE_CHECK_ONLY_SENTINEL}\nselected: *defaults\n")
+        computation_fixture(project, inputs=["_practices/fixture/data/input.csv", "_practices/fixture/data/parameters.yml"])
+        chapter = project / "_chapters/ca/first.md"
+        original = chapter.read_text()
+        original = original.replace('![Alt](assets/img/map.png "Mapa de prova"){: data-caption-source="Autoria sintètica"}',
+                                    '<img src="assets/img/map.png" alt="Alt `code`" title="Caption `literal`">')
+        write(project, "_chapters/ca/first.md", original)
+        commit(project, ["_practices/fixture/data/input.csv", "_practices/fixture/data/parameters.yml", ".unaltraweb/computations.yml", ".unaltraweb/computations.lock.json",
+                         "assets/compute/figure.qmd", "assets/img/figure.svg", "_chapters/ca/first.md"], "P1/P2 synthetic native check inputs")
     first = asyncio.run(export(project, "v1", args.image))
+    if args.private_inputs_html:
+        verify_private_inputs_html(project, first["export"])
     save(output / "producer-v1.json", first)
     command = [sys.executable, "-B", "-m", "unaltraweb_mcp.cli", "--project", str(project), "mcp", "manual-context-export",
                "--name", "cli-block", "--language", "ca", "--chapter", "first", "--section", "first#method"]
@@ -96,13 +123,16 @@ def main():
     assert cli["ok"] and cli["sections"] == 1 and cli["figures"] == 1, cli
     save(output / "producer-cli.json", {"command": command, "result": cli})
     result = {"ok": True, "synthetic_manual": True, "producer_export_invoked": True, "transport": "mcp-stdio",
-              "first": first["export"], "cli_verified": True, "questions_generated": 0}
+              "first": first["export"], "cli_verified": True, "questions_generated": 0,
+              "private_inputs_html": args.private_inputs_html, "computation_render_executed": False}
     if not args.single:
         original = (project / "_chapters/ca/first.md").read_text()
         write(project, "_chapters/ca/first.md", original + "\nSegona versió: text afegit.\n")
         write(project, "_chapters/ca/second.md", "---\ntitle: Segon\nref: second\nlang: ca\nweight: 20\n---\nCapítol afegit en la segona versió.\n")
         commit(project, ["_chapters/ca/first.md", "_chapters/ca/second.md"], "Second fixture revision")
         second = asyncio.run(export(project, "v2", args.image))
+        if args.private_inputs_html:
+            verify_private_inputs_html(project, second["export"])
         save(output / "producer-v2.json", second)
         result["next"] = second["export"]
         assert first["export"]["manual"]["id"] == second["export"]["manual"]["id"]

data/scripts/unaltraweb-mcp-bootstrap.sh

@@ -15,7 +15,7 @@ Managed mode requires an immutable reference or an expected full image ID.
 USAGE
 }
 
-image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:10bcaf1411f27a518969283a77e23dcc99119014b216270b3089ba85ba0b6c7e}"
+image="${UNALTRAWEB_MCP_IMAGE:-ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:8b41abacad9ca2894755db7f3587a6b47c8fa8f536d88a151bdfc4ae53ba7f08}"
 project="${MCP_CONSUMER_WORKSPACE:-${UNALTRAWEB_PROJECT:-}}"
 operation=serve
 expected_image="${UNALTRAWEB_EXPECTED_IMAGE_ID:-}"

data/src/unaltraweb_mcp/component-contract.json

@@ -2,8 +2,8 @@
   "$schema": "component-contract.schema.json",
   "schema_version": 1,
   "release": {
-    "version": "0.8.0",
-    "tag": "v0.8.0"
+    "version": "0.8.1",
+    "tag": "v0.8.1"
   },
   "consumer_integration": {
     "schema_version": 1,
@@ -62,10 +62,10 @@
     "gem": {
       "kind": "gem",
       "name": "unaltraweb",
-      "version": "0.8.0",
-      "release": "v0.8.0",
+      "version": "0.8.1",
+      "release": "v0.8.1",
       "release_status": "ready",
-      "reference": "unaltraweb (= 0.8.0)",
+      "reference": "unaltraweb (= 0.8.1)",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
       "features": ["jekyll-core", "site-build"]
@@ -73,10 +73,10 @@
     "wheel": {
       "kind": "python-wheel",
       "name": "unaltraweb-mcp",
-      "version": "0.8.0",
-      "release": "v0.8.0",
+      "version": "0.8.1",
+      "release": "v0.8.1",
       "release_status": "ready",
-      "reference": "unaltraweb-mcp==0.8.0",
+      "reference": "unaltraweb-mcp==0.8.1",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": true,
       "features": ["calibre-import", "doctor", "new-web", "offline-inspection", "mcp-control-plane", "source-ci"]
@@ -84,10 +84,10 @@
     "runtime": {
       "kind": "container",
       "name": "unaltraweb runtime",
-      "version": "0.8.0",
-      "release": "v0.8.0",
+      "version": "0.8.1",
+      "release": "v0.8.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.8.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb:0.8.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,
@@ -96,10 +96,10 @@
     "mcp": {
       "kind": "container",
       "name": "unaltraweb MCP runtime",
-      "version": "0.8.0",
-      "release": "v0.8.0",
+      "version": "0.8.1",
+      "release": "v0.8.1",
       "release_status": "ready",
-      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.8.0",
+      "reference": "ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.8.1",
       "image_repository": "ghcr.io/dosquartsdedocs/unaltraweb-mcp",
       "repository": "https://github.com/dosquartsdedocs/unaltraweb",
       "included_in_wheel": false,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unaltraweb
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - dosquartsdedocs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-03 00:00:00.000000000 Z
+date: 2026-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: classifier-reborn
@@ -808,6 +808,8 @@ files:
 - docs/agents/deployment-integration-0.7.1.md
 - docs/agents/manual-authoring-components.md
 - docs/agents/manual-context-121.md
+- docs/agents/manual-context-fix-121.md
+- docs/agents/manual-context-pilot-review-121.md
 - docs/agents/mcp-contract.md
 - docs/agents/owner-closeout-76.md
 - docs/agents/owner-closeout-80.md
@@ -859,6 +861,7 @@ files:
 - scripts/manual/verify_release_assets.py
 - scripts/prepare_practice_candidate.py
 - scripts/prepare_practice_editions_candidate.py
+- scripts/review_manual_context_pilots.py
 - scripts/test_gem_build.py
 - scripts/test_manual_context_export.py
 - scripts/test_reproducible_jekyll_build.py