[Relay #33.4] Prove Repository Intelligence publication in Empathy

[szmyty]

Outcome

Migrate Empathy's two Repository Intelligence integrations from Relay v1.4.0 (b71b090406a3a9e4cd9f107e9d14a623bbecb127) to the hardened Relay contract, then prove publication in a complex consumer without weakening Mindgarden, Quartz, report-snapshot, or Pages ownership boundaries.

Scope

• Upgrade the immutable Relay pins in:
  • .github/workflows/repository-intelligence.yml
  • .github/workflows/mindgarden-pages.yml
• Preserve the Mindgarden public projection, pinned Quartz build, normalized report inputs, and consumer-owned Pages deployment.
• Preserve refreshes triggered by trusted default-branch producer workflow_run events, including runs whose conclusion is not successful.
• Add or retain reviewable PR artifacts without allowing PR deployments.
• Exercise pull-request, default-branch push, producer refresh, manual rebuild, failure-retention, deployment, and rollback paths.
• Bind the consumer commit, Relay commit, report snapshots, bundle digest, workflow run, Pages deployment, and public routes in durable evidence.

Acceptance criteria

• Both Repository Intelligence integrations use the same reviewed immutable Relay revision and compatible contract versions.
• All remote actions remain commit-pinned.
• Pull requests validate the complete Mindgarden/Quartz/Repository Intelligence composition and retain a review artifact without deploying.
• Untrusted pull requests cannot publish report snapshots, deploy Pages, expose secrets, or enter a privileged workflow_run path.
• Trusted producer workflows refresh Repository Intelligence from the default branch even when their conclusion represents useful failure evidence.
• Missing, stale, failed, or schema-incompatible producer evidence remains visibly unknown, stale, or failed and never becomes a misleading green result.
• A trusted main, producer-refresh, or manual run deploys only through Empathy's existing Pages job.
• Relay writes only the Repository Intelligence subtree and does not replace the Quartz/Mindgarden site.
• /intelligence/ and its complete route set are verified at Empathy's configured public origin.
• Existing Mindgarden routes and the reviewed/public projection boundary remain intact.
• Provenance records the exact Empathy SHA, Relay SHA, report/input contract versions, bundle digest, triggering run, deployment identity, and public URL.
• Rebuilding identical declared inputs produces an equivalent declared bundle.
• A controlled negative path retains a sanitized failure report with stage, rule, and remediation while preserving the last known-good public deployment.
• Rollback evidence identifies the previous Relay pin, last known-good deployment, and exact revert procedure.
• Tests and documentation cover PR safety, immutable dependencies, workflow-run refreshes, composition order, deployment gating, live routes, and rollback.

Dependencies

• Parent: Publish deterministic Repository Intelligence through reusable GitHub Actions relay#33
• Blocked by: [Checkpoint 33.1] Harden Repository Intelligence workflow trust and durable failure evidence relay#104
• Blocked by: [Checkpoint 33.2] Bind Repository Intelligence artifacts to consumer deployment provenance relay#105
• Ordered after: [Relay #33.3] Prove Repository Intelligence publication in Akashic akashic#185

Non-goals

• Replacing or reconfiguring MegaLinter, OSV, OpenSSF Scorecard, SARIF, or their native GitHub integrations.
• Changing Mindgarden review/publication semantics or Quartz ownership.
• Configuring Empathy's future custom domain.
• Publishing raw logs, SARIF, private workflow context, or transient artifact URLs.
• Giving Relay deployment authority.

Verified consumer checkpoint

Completed: final acceptance matrix.

PR #95 implemented the hardened consumer. Repair PR #97 merged at 56967b2ba14e61643472f95b0b7233a6c7da58f9, tree 83cc7be8c2e6339b810538da88b3d8faab307bf0, matching its reviewed tree. Merged deployment evidence and merged/current validation evidence verify the repair and subsequent dependency PR #96. The holistic scan has no introduced gating findings in the reviewed scope; remaining repository baseline failures and warnings are explicitly retained.

Final verified main and public revision: d160044e08f3377afdf14f4856bc470ddd53b769, tree 6595e752d14ffcf841d59c9ef87f27c871f62096. Run 35869039387/1 and complete artifact/receipt/live proof establish actual build, deployment, receipt finalization, 82-file composition, 63 preserved Quartz files, same-context deterministic duplicate output and all 17 public routes. The final independent check completed 2026-09-23T13:51:01.265882Z; producer and publication queues settled. Both integrations retain Relay 9a6315978766c336566b9fa7139b800fa8789ba5.

Producer refresh evidence distinguishes implementation merges from report-only descendants, retains original producer identities, admits useful non-successful conclusions, and preserves invalid/unknown/unavailable states.

Earlier operational evidence remains scoped to its recorded revisions: default deployment, failed-producer refresh, manual current, sanitized RIW-002/no-publication failure, historical rollback, and immediate current restoration. Their applicability after the focused repair and action-pin updates is reviewed in the acceptance matrix; they are not described as newly repeated.

Empathy remains the only composition/deployment authority; Mindgarden review, pinned Quartz, public-safe diagnostics, PR/untrusted boundaries and separate receipts remain intact. AGENTS includes canonical exact-head holistic validation requirements. Relay #109 retains checkout-name portability scope. Observatory-unavailable evidence remains intentional and independent.

This consumer checkpoint is complete. Relay #33 and Relay #106 remain open for the separate final reconciliation.

[szmyty]

Implementation and PR validation are complete in Empathy PR #95, now ready for review and unmerged.

• Branch: agent/prove-repository-intelligence-94
• Reviewed head: 9916165cd6e20ce1186a62b7d2f25333e33be1b5
• Tree: 792b4a86e83a7cafb99342a4489285a3d7fe8997
• Represented GitHub PR merge: 3e4e05412ef8311fb0b0d61380255536a818186b, with the same tree.
• Both current integrations use reviewed Relay 9a6315978766c336566b9fa7139b800fa8789ba5; Quartz and the Mindgarden review boundary remain unchanged.

Final provider/artifact proof records current/rollback build runs, standalone output, 81 contract checks, actual scheduler outcomes, all ten retained archive links and verified ZIP digests, manifest/bundle/composition hashes, report input identities, and the fixed historical rollback evidence. All 63 Quartz files were preserved. PR Pages uploads, deployment, receipt finalization, and live verification were skipped; no Pages artifact was uploaded.

Validation and security review records 194 local root tests with no skips, complete garden/architecture and owner validators, strict parsing/syntax/lint/diff checks, and green exact-head MegaLinter. The unrelated catalog-pin assertion and unchanged OSV findings remain documented baseline failures.

Operational acceptance remains pending: merged default-branch deployment and exact live identity; manual current; trusted producer refresh including useful non-success evidence; sanitized 30-day RIW-002 negative-path report with no deployment/Pages artifact; actual rollback-v1.4, immediately followed by restored current; and the corresponding deployment receipts and complete route evidence. These cannot be claimed from PR builds.

This issue remains open. Relay #33 and Relay #106 remain open. Relay #109 separately tracks checkout-directory portability; AGENTS/publication guidance now requires explicit provider-stage evidence, declared repeatability scope, reference-only issue wording, and the canonical CI lint policy.

[szmyty]

Merged default-branch evidence is verified below. Empathy #94 remains open while manual, failure, rollback, and restored-current acceptance is completed.

Run 35852827400, attempt 1 completed success. Event: push; represented source d9059e36d07d959172ff2e8df7ed864b77435b81; exact tree 792b4a86e83a7cafb99342a4489285a3d7fe8997. This report preserves that immutable deployment even if later report-snapshot commits advance main.

Stage	Job	Result
Validate and build public garden (current)	107154279357	success
Deploy public garden	107155531270	success
Record separate deployment receipt	107155631003	success
Verify served revision and public routes	107155675711	success

The deploy log explicitly selected Pages artifact 10746202480, submitted pages_build_version=d9059e36d07d959172ff2e8df7ed864b77435b81, returned deployment ID d9059e36d07d959172ff2e8df7ed864b77435b81, and reported success at 2026-09-23T11:13:02Z. Finalization recorded the receipt at 2026-09-23T11:13:09Z for github-pages, https://egohygiene.github.io/empathy/, conclusion success.

• Relay owner and generator: 9a6315978766c336566b9fa7139b800fa8789ba5 (v1.6.0); verifier imported from an exact pinned checkout and its source bytes compared with that Git object.
• Pinned Quartz: 075afd3f712da0088a07f5284a7b3aba37dd61b6; profile sha256:11520d28fb34db72d60a32a5e17f19f327feb536015b584ef4d97697aff75fb1; configuration sha256:2221600b76f7cb8c4021451feca88cb10abf52759fce95a832bf6b0bac1cc84a. Both configuration hashes rechecked against represented source.
• Build manifest: sha256:97fdd05c07ff79a52f7a176a9dce8160c155e60350bea41fc1572cf6ebfd6065.
• Repository Intelligence payload: sha256:a7d88b9080158a66a1a7e13f447b8c9fbd2008f498f4bf69bb74a2fc235055bf; 18 files, 2,254,914 bytes, plus the separately validated manifest.
• Complete public composition: sha256:25473ce96f173ec77aea06ad8dc97e9b94593df1cf97a648fdfc04b5ac07c07f; 82 files.
• All 63 pre-composition Quartz files preserved byte-for-byte: sha256:03c64bf0154330cb2bffa5c81e4b25820a5ca3b9969825104fb967737c91b306; preserved garden routes /, /projects/, /tags/.
• Independent inventory comparison confirms the actual uploaded Pages tar contains exactly the retained 82-file composition. Tar SHA-256: sha256:f863c1ff54b3a6607dcba39641b6f0ea8b6fe5cbc0f054f114e8e17225d886b0. No hidden .nojekyll marker was added or assumed.
• Duplicate-build report proves two Relay builds on the same Quartz composition and checkout yielded identical complete inventories and manifest bytes. It does not claim that fresh Quartz builds or differently named checkouts are byte-identical.
• Separate deployment receipt JSON: sha256:8d1c63250e3a7097d3cfc40e616fa69ce26180c11236b2518789e9960ebe41a2; reconstructed using the pinned owner at the receipt verification epoch and compared for exact equality. It binds this run/attempt, source, Relay pin, manifest, composition, deployment outcome, and fixed rollback identity. No receipt occurs in the public tree.
• Provider live JSON: sha256:ce818bfafdca0d44e4b0a9652345564ce7bde5a60ba41610020f0bbeafa71589; full exact route checks completed 2026-09-23T11:13:32.289860Z, attempt 1. Independent direct verification completed 2026-09-23T11:15:54.193486Z, attempt 1; manifest checked before and after all 17 direct HTTP200 responses with redirects refused.

Producer	Source revision	Execution / schema state	Exact summary SHA-256
osv	98778e8442d3be3ea7a3d1f62b71f33969346ecc	success / recognized-schema	sha256:8d9d499e7b31fef422901df19e2de563020c32e780af955e3fe6b24bd4431c68
megalinter	254185272ab27b6858b8b0393af6549c205c9a8d	failure / recognized-schema	sha256:a43d74da57e4d931e8524d051328a68719ae230f5865f8aa212baa420f213c35
scorecard	—	unknown / missing	—

All retained input records were rechecked against this deployment’s Git source. Existing OSV and MegaLinter snapshots represent earlier commits, so public availability remains invalid, findings/freshness unknown; missing Scorecard remains unavailable/unknown. These do not become green data. The sanitized successful build report is allowlisted metadata only, under 8 KiB, with every required stage successful and publication_expected=true.

All six ZIP archives were downloaded and independently SHA-256 checked against provider metadata. Paths were checked for traversal/absolute entries, duplicates, and symlinks before reading; the Pages tar also rejects links and special files. Review, provenance, receipt, live, and diagnostic retention is 30 days; the actual Pages artifact is one day.

Artifact	ID	ZIP SHA-256	Expiration
empathy-live-35852827400-1	10746227360	sha256:3f364ad50a138fa4ef4c9f02eae792f4fa165e3c37c89f57c4e6d755068ae593	2026-10-23T11:13:32Z
github-pages	10746202480	sha256:4efdb00959358cf026023623e779974181a2a9de6a89a04e31b6ed44e3087e69	2026-09-24T11:12:37Z
empathy-deployment-receipt-35852827400-1	10745974566	sha256:86949ac8b4926c2800d61704093aa76a3566120ea10c1cf87ca1b8fb9894c5da	2026-10-23T11:13:09Z
empathy-provenance-current-35852827400-1	10745918019	sha256:72296d2901e301e595a39fcfcd5337ccf2176a1e47a7849b26ec7266a889d12e	2026-10-23T11:12:35Z
empathy-publication-report-current-35852827400-1	10745908232	sha256:18444967cec108e9c9b63e94ab0279ffeb54ce040358bc8a5d44707eb51fba26	2026-10-23T11:12:39Z
empathy-composed-current-d9059e36d07d959172ff2e8df7ed864b77435b81-35852827400-1	10745813074	sha256:8c7cfd374927c683552b3ff9eaa69b9dd461b10137b184566abf5ac30b0495a6	2026-10-23T11:12:33Z

Each route below returned HTTP200 and exactly matched retained composed HTML in both provider and independent direct verification.

Route	SHA-256
/	sha256:64881d7fb759cb81b44ab9a7157caeb6f9cdc93440dc68b96d8a13981780b3ea
/dashboard.html	sha256:1acc33f50d8a458bd4ec02f11bccdc5f7bdfb13e6ed01d91c807e628d258dcc6
/projects/index.html	sha256:968d44627505c16db02cd96c36b5fcac3bdab4ed380d6d87ad62d6c97bcb6138
/projects/egohygiene-web-namespace.html	sha256:338fcd782fb64a4c6f94537ac480b75501ae609fcb9153f0738530ed73196916
/projects/repository-intelligence-dashboard.html	sha256:a0b36f4c98713ab7587c6185d24b76ede789a06b209b10409c44c7cf944d6e32
/intelligence/	sha256:4790b73910c3ee452eeca841b57dd46214694cf07f6c3dac6256ff920c1d3694
/intelligence/now/	sha256:b4f726cd119a5909b1d0a8128320a9373652554772eac9a4f9fd9a796338d125
/intelligence/roadmap/	sha256:13aacbe5ffb62b3a9d64c48b8f37d74cf4bad7a611571b64120c6940d4031681
/intelligence/decisions/	sha256:77150d134031d657c003e073161dbd6a65820c2e2364b8524a95ce794aa86650
/intelligence/journey/	sha256:8025ebea664cbe1d3aaf7c3b7027b75ce9186dedd4dfbec6094a4a595ce6396b
/intelligence/dependencies/	sha256:b62c0a3fc3e13345bc5601b8f7a06a73edc0a245e3a4754068d6754fbf30e194
/intelligence/health/	sha256:599b7e528bb207975f7f43a66c2d17851fd488a2b800473233c0f21dc5ee5196
/intelligence/releases/	sha256:a3dd5a1c205e8edb8fea6cd4547f2ed13efcf728a13f4d0aa862912621282abb
/intelligence/work/	sha256:5e3d6a8851d225cf5d44da08a1490bc13e341fc2184182edabc09736fa80a03f
/intelligence/search/	sha256:247e67490ab16e845678273bd6f888dd2ed6d1a4bee10232e99ea3d88fabe6da
/intelligence/compare/	sha256:c1e68f5866384aa9233fdd9829434b85362931fcd1e62799284de0e09c2e4a0f
/intelligence/dashboard/	sha256:36815ac8226d09b48f287c3e73b8679431a752e6fb02e6fbf7c90995b241dfc0

The public identity URL /intelligence/build-manifest.json matched the manifest hash above before and after each probe sequence. These timestamps establish what was served then; later successful producer refreshes can legitimately replace it.

[szmyty]

Trusted producer refresh, including a failed producer

Automatic Pages run 35853037009 / attempt 1 succeeded through build, deployment, separate receipt, and live verification. It represents consumer revision bf00f8dfc647e810d25357a412c5424d27b4ca95, tree 6f8a1a7edb3b2335a7eacadda41036e25312e58e, the report-only child of merge d9059e36d07d959172ff2e8df7ed864b77435b81.

Retained publication/inputs.json explicitly identifies trusted default-branch OSV producer 35852827499 / attempt 1, event push, same repository, original head d9059e36d07d959172ff2e8df7ed864b77435b81, and conclusion failure. Its scan failed the severity threshold; curated snapshot publisher job 107154563411 succeeded. The refresh admitted this useful non-success conclusion and completed all four publication stages.

OSV artifact 10746420763 ZIP digest is sha256:a5c90a06bea5e4252bdbad1f6544596c19075ab7b70cc84c9a031782f1e87582. Its normalized summary exactly matches the bytes committed in bf00f8d: sha256:95cee12101b4f42339856ae939265dcccafaaa1073507a4f7de2f5dfce5c5edb. Original source identity remains d9059e3, scan execution is success, and findings remain blocked (85 blocking, 167 total). The publisher did not rewrite the evaluated source to the later snapshot commit.

All six refresh artifacts were downloaded and their ZIP digests recomputed:

Artifact	Link	Verified ZIP SHA-256
empathy-deployment-receipt-35853037009-1	10746622591	sha256:9a62f3eca8f6bcd149bc0a9f0b23aef64aba8811f8d07fae7773d17e053bf92f
empathy-publication-report-current-35853037009-1	10746441919	sha256:6915e0eba62f5aa5d7f32669472eb5fc4c4a590a6ef9175197f1b8d010935007
github-pages	10746332339	sha256:11700f4acd7e6a8d2e79c30bac4e60ecf0d95b0f46bdd47f70824c3d3780e823
empathy-provenance-current-35853037009-1	10746282731	sha256:d370e315353172ec38a6cac3f26a504ed4e0bd05f49d369e3f0140d980f36d7e
empathy-live-35853037009-1	10746257991	sha256:d7506888fe92f86df47a9dad14a6974e39b7d55c0d3b99a8cc99b1d581f78cd5
empathy-composed-current-bf00f8dfc647e810d25357a412c5424d27b4ca95-35853037009-1	10746242814	sha256:c209ad8cf83ad2d24dbd4d4fcb3b6b6a492b2276bd3bb4552d89e387525b2a41

The review ZIP, provenance ZIP, and Pages TAR contain the same 82 site files. All 18 manifest-listed Repository Intelligence payloads were rehashed; 63 consumer files remain preserved. The duplicate-build report is identical within the declared same-Quartz-composition/checkout scope.

• Input evidence: sha256:d3902da47f47069037a019efd7faf9cc0ded40a9b057615c8c06588ded06920c.
• Manifest: sha256:ecd4d7bb4ab24c9d97856db3b06d142b6c656496b8eb98cc3e3340b9db37fdf5.
• Repository Intelligence bundle: sha256:050a121c525408b889cbc4acfe5fd7eefa01c61125d22e20620249253b699631.
• Full composition: sha256:41459553df9e7ce493d43a4d1f2fcd6464a478bd8477a66cfc56ce0ca220b690.
• Separate receipt JSON: sha256:cdaf985ec4c40b0ba7577fa7be50b66a49a0d031d5ab665187478d0de797b116; success, environment github-pages, run 35853037009, attempt 1.
• Live report JSON: sha256:2903cea558dab3fd70b60665e76b44d787ceb3f8093cb9b98dab9936f51a7073; 17 HTTP 200 routes, every hash matching the retained site, plus exact manifest identity.

Direct public GETs at 2026-09-23T11:20:10.230549+00:00 independently matched the retained manifest and complete public summary bytes for bf00f8d.

Input freshness and missing-data behavior stayed honest. The input record preserves OSV source d9059e3, older failed MegaLinter source 2541852 and digest sha256:a43d74da57e4d931e8524d051328a68719ae230f5865f8aa212baa420f213c35, and missing Scorecard evidence. Because neither supplied snapshot represents the snapshot-publication commit bf00f8d, the public dashboard exposes OSV/MegaLinter as incompatible with failure/unknown findings rather than green values. Scorecard remains unavailable/unknown. Original report identities remain reviewable in the separate input artifact.

Scorecard producer 35852827405 / 1 scanned successfully but its existing publisher failed at unsupported git rm --recursive (exit 129), before normalization/publication. This does not invalidate the separate successful OSV refresh. Earlier pending Pages run 35853007494 / 1 was cancelled without any job or artifact.

Subsequent producer refresh and denied publication paths

MegaLinter producer 35852827468 / 1 completed with failure; its curated snapshot publisher 107157121970 succeeded, committing report-only revision 9da148f0488a1a22240d922dadc1b227e30d280f, tree f9684994bd89baa265a2407b0cab3293eefe6b5c, parent bf00f8d. Automatic refresh 35853792460 / 1 completed all four jobs successfully: build 107157407633, deployment 107158653892, receipt 107158744766, live verification 107158802182. Its committed normalized MegaLinter summary still identifies original evaluated source d9059e36d07d959172ff2e8df7ed864b77435b81, run 35852827468 / 1, execution failure, and byte digest sha256:7b96fa1beed6245d08224c3a79c62e255b5d6b4243713ebaf19d938880d37efd. The root-owned manual/current restoration audit will validate the full final-9da artifact set; this audit did not duplicate all six intermediate Mega refresh archives. No dispatches, cancellations, or repository mutations were performed during this audit.

Successful Dependabot PR #96 MegaLinter run 35853697613 / 1 is explicitly a pull_request event at 8e59e02a197ba061eaa444ea5e0a1fcacbdf7c71, branch dependabot/github_actions/github-actions-2cc136df07. It completed at 11:21:04Z; workflow-run Pages 35854022130 / 1 followed at 11:21:07Z and completed skipped. This association is inferred from timing because the Actions REST run record does not expose the upstream event payload. The PR producer event and denied publication outcomes were independently verified.

Both 35854022130 / 1 and earlier 35853781565 / 1 contain four skipped job records, zero executed jobs, and zero artifacts. Build, deployment, receipt, and live verification were all denied. This is an actual provider denial observation; no fork-origin or cancellation experiment is claimed.

At the final queue observation, all three original push producers were complete, no publication run was active or pending, and main remained 9da148f0488a1a22240d922dadc1b227e30d280f. Manual current, intentional failure, rollback, and restoration sequencing remain root-owned.

[szmyty]

Empathy #94 manual current rebuild publication proof

Run 35854445718, attempt 1 completed success. Event workflow_dispatch; represented source 9da148f0488a1a22240d922dadc1b227e30d280f; exact tree f9684994bd89baa265a2407b0cab3293eefe6b5c. This report preserves that immutable deployment even if later commits advance main.

Provider execution

Stage	Job	Result
Validate and build public garden (current)	107159497760	success
Deploy public garden	107160552044	success
Record separate deployment receipt	107160615798	success
Verify served revision and public routes	107160662929	success

The deploy log selected Pages artifact 10747180512, submitted pages_build_version=9da148f0488a1a22240d922dadc1b227e30d280f, returned deployment ID 9da148f0488a1a22240d922dadc1b227e30d280f, and reported success. The separate receipt was recorded at 2026-09-23T11:29:14Z for github-pages, https://egohygiene.github.io/empathy/, conclusion success.

Independently verified inputs and output

• Exact pinned Relay owner and generator: 9a6315978766c336566b9fa7139b800fa8789ba5 (v1.6.0); owner source bytes checked against that Git object.
• Quartz pin 075afd3f712da0088a07f5284a7b3aba37dd61b6; profile sha256:11520d28fb34db72d60a32a5e17f19f327feb536015b584ef4d97697aff75fb1; configuration sha256:2221600b76f7cb8c4021451feca88cb10abf52759fce95a832bf6b0bac1cc84a. Configuration hashes rechecked against represented source.
• Manifest sha256:5c4e928e45ba680d457cfbe450e5c83ba6665e1ca447ce2058d69269d802e851.
• RI bundle sha256:ae76456fb5f1c9a20e4828b7ac1977ac93c8aa8eeb3b0080eb83426ef56279d1; 18 files, 2,254,914 bytes, plus validated manifest.
• Complete composition sha256:ad860710c0fb0cfd92894ffef25395a30a92fb087b098fc3dcc463d0f60b22c1; 82 files.
• All 63 Quartz files retained byte-for-byte: sha256:b3588826c7a3e7e64a527b75275382fe4fdca5a059f541f392d88a0ec975884f. Garden /, /projects/, /tags/ preserved.
• Actual uploaded Pages tar equals the retained complete composition inventory. Tar sha256:78e0796e0ebf69d845cfd860c211e7fcfe91cfab0ad2f298910d86672a5c52f6. No .nojekyll marker was added or assumed.
• Repeatability evidence confirms two Relay builds on the same prebuilt Quartz composition and checkout yielded identical inventories and manifest bytes; fresh Quartz builds and differently named checkouts remain outside this claim.
• Separate receipt JSON sha256:58cae4323abc75a8e3909e9e20655d16444ebad9fc50db807a992efb0c67b2ec; reconstructed using the pinned owner at the receipt verification epoch and compared for exact equality. It binds this run/attempt, source, Relay pin, manifest, composition, deployment result, and fixed rollback identity. No receipt is public.
• Provider live report sha256:211bc6082c093151ffe11f28da86d21ff1bc531a67a9c74336e8a6ac40d61400; all 17 exact routes verified 2026-09-23T11:29:34.758946Z, attempt 1. Manifest checked before and after; redirects refused.
• Independent direct public verification also passed all 17 exact routes and identity checks at 2026-09-23T11:32:10.424883Z, attempt 1.

Normalized report inputs

Producer	Actual source revision	Execution / schema state	Summary SHA-256
osv	d9059e36d07d959172ff2e8df7ed864b77435b81	success / recognized-schema	sha256:95cee12101b4f42339856ae939265dcccafaaa1073507a4f7de2f5dfce5c5edb
megalinter	d9059e36d07d959172ff2e8df7ed864b77435b81	failure / recognized-schema	sha256:7b96fa1beed6245d08224c3a79c62e255b5d6b4243713ebaf19d938880d37efd
scorecard	None	unknown / missing	None

Input hashes were independently rechecked against represented Git source. Public producer states:

Producer	Availability	Execution	Findings	Freshness
megalinter	invalid	failure	unknown	unknown
osv	invalid	failure	unknown	unknown
scorecard	unavailable	unknown	unknown	unknown

The successful publication report is bounded allowlisted metadata, includes every required stage as successful and publication_expected=true; public unknown or invalid report evidence is not rewritten as green.

Artifact transport digests

All six ZIPs independently downloaded and checked against provider SHA-256 metadata. Archive paths reject absolute/traversal entries, duplicates, and links; Pages tar also rejects special files. Separate evidence retention is 30 days; the Pages artifact is one day.

Artifact	ID	ZIP SHA-256	Expiration
empathy-publication-report-current-35854445718-1	10747245305	sha256:ed4f60fe19013a46d22b7417f76d6cf5fa5230406bf5ec4e002b2e5f2abcedf2	2026-10-23T11:28:51Z
github-pages	10747180512	sha256:f3aa730afe06702737c5334e0e4633db39fbf415ce621e123b633c2f4082d4d2	2026-09-24T11:28:50Z
empathy-live-35854445718-1	10747086871	sha256:6819ee0cbce5652cff2cb6273196eb13d8fbc631891b4939a3c69b8a0ebd3a15	2026-10-23T11:29:34Z
empathy-provenance-current-35854445718-1	10747070962	sha256:1de630f7263df4c20887b3ee3c8c0db39062aa48c5458b33a7ff1004a1f28965	2026-10-23T11:28:48Z
empathy-composed-current-9da148f0488a1a22240d922dadc1b227e30d280f-35854445718-1	10746219611	sha256:1f44c7f3b7888d6ecbd6461d860755474127e9abad898f453e464b1341c61138	2026-10-23T11:28:46Z
empathy-deployment-receipt-35854445718-1	10746209710	sha256:fac251e9e28fbc49b5bc3c8c1520369b98b4b0f0cf5c96b303706d5984df15fe	2026-10-23T11:29:15Z

Live route bytes

Every following route returned HTTP200 and exactly matched retained HTML. Identity URL /intelligence/build-manifest.json matched the manifest digest above before and after each full probe sequence.

Route	SHA-256
/	sha256:64881d7fb759cb81b44ab9a7157caeb6f9cdc93440dc68b96d8a13981780b3ea
/dashboard.html	sha256:1acc33f50d8a458bd4ec02f11bccdc5f7bdfb13e6ed01d91c807e628d258dcc6
/projects/index.html	sha256:968d44627505c16db02cd96c36b5fcac3bdab4ed380d6d87ad62d6c97bcb6138
/projects/egohygiene-web-namespace.html	sha256:338fcd782fb64a4c6f94537ac480b75501ae609fcb9153f0738530ed73196916
/projects/repository-intelligence-dashboard.html	sha256:a0b36f4c98713ab7587c6185d24b76ede789a06b209b10409c44c7cf944d6e32
/intelligence/	sha256:d5bb226079420bd84895c8a56668eff0ce9651d0cb631f813c6bfc48b1e38b3f
/intelligence/now/	sha256:036e98ddfe51509fe9710f5770fcab614b6776a9afe473f6bf58d899b2cf3cc2
/intelligence/roadmap/	sha256:b9f38779ba1cbb7fc9e17054e4a334611a3dcb39451a6de1f4b226b1a3dfec1c
/intelligence/decisions/	sha256:ac6afefd3f55386c6f9f2c2b34278f700d5e9e02b48d78d1f28b33e645f37b49
/intelligence/journey/	sha256:39b5585db3136329592036dccc953c3025a017fee691ea757b5da9fc089619e3
/intelligence/dependencies/	sha256:a89fad9c01965ee186c06d97c64a740b453e99d5942d55fdb6724d37efe71a87
/intelligence/health/	sha256:9c06466716a58c71bf24916e98886f6f80f225458d93d36e5829150b858bf616
/intelligence/releases/	sha256:d41a5fcb0969a2db19fe79f64b895d03b2615cd74850f72849dfb8094ffa7d7d
/intelligence/work/	sha256:1ad35badf56331330ae1be5b18e40f9c8bb33f7b4b9bbf06e3a8fd1362d35846
/intelligence/search/	sha256:0332c108ab777c9f957dd2730737a4e008f56ae702308cdcdb6005ad3d29f046
/intelligence/compare/	sha256:37e21ad614ad0b00f1173af07150bf86e2ad6ada1e3b31938bc896b02e43a40f
/intelligence/dashboard/	sha256:54880b611db01c3e21f96cbafb3e2519b7f24b87f515e0f2639639bcc26545d4

This evidence identifies what was served at its recorded timestamps; later successful refreshes may replace the live deployment. #94 remains open pending the remaining rehearsal evidence and the introduced holistic-validation repair.

[szmyty]

Intentional failure acceptance verified for run 35855095637, attempt 1 at consumer revision 9da148f0488a1a22240d922dadc1b227e30d280f / tree f9684994bd89baa265a2407b0cab3293eefe6b5c, using Relay 9a6315978766c336566b9fa7139b800fa8789ba5.

The dedicated max-depth: "21" fixture fails at trust-and-input-validation with RIW-002 and rule repository-intelligence.workflow.trust-and-input-validation. Its only job 107161579251 retains evidence and reasserts failure. The preflight step's provider conclusion is success only because continue-on-error is enabled; logs explicitly record its actual failure outcome.

Checkout, generation, provenance verification, and public site upload all remain skipped. The workflow has only contents: read, no Pages or OIDC authority, no deployment job, and no Pages or public-site artifact. Exactly one ordinary Actions artifact exists: the sanitized failure report.

• Artifact: relay-report-repository-intelligence-v1-35855095637-1 (ID 10746978262; 1641 bytes).
• Downloaded ZIP: sha256:e9278b632278ca8ee3831ccc72c8ccaf5e2a58224d84908068cf13ca48d6c981; independently recomputed and equal to the provider digest.
• Report payload: sha256:d69b1e86a8f4d43d0d60abd88b7d9d035034309bf531e919ab2bffe22bda3cc4 (1561 bytes).
• Preservation manifest: sha256:f9c269bb050a389e1988433db888ed68486a7818854bba2a79e7bcbd17aa0743.
• Both entries in SHA256SUMS verified. Archive contains only those two JSON files and SHA256SUMS.
• Retention: 30 days, generated 2026-09-23T11:32:28Z, expires 2026-10-23T11:32:28Z. The preservation manifest bounds report content to one file / 32768 bytes.
• Strict duplicate-key parsing and exact closed field/value checks passed. The report contains only allowlisted metadata, the stage/code/rule, represented revision, run/attempt, artifact status, and pinned remediation; no raw logs, report inputs, local paths, tokens, or scanner payloads.

Direct public manifest probes before (2026-09-23T11:31:35.548252Z) and after (2026-09-23T11:33:03.028872+00:00) the failed run both returned the exact same bytes: sha256:5c4e928e45ba680d457cfbe450e5c83ba6665e1ca447ce2058d69269d802e851, representing 9da148f0488a1a22240d922dadc1b227e30d280f. The after probe was HTTP 200 with no redirect and completed before rollback was dispatched. This negative path did not change the live site.

[szmyty]

Empathy #94 independent live rollback proof

Run 35855334498, attempt 1 completed successfully in rollback-v1.4 mode. All four actual jobs executed successfully. The workflow revision is 9da148f0488a1a22240d922dadc1b227e30d280f, tree f9684994bd89baa265a2407b0cab3293eefe6b5c; the rebuilt and publicly represented historical consumer is 254185272ab27b6858b8b0393af6549c205c9a8d, tree a5cdaba679c8c0b9d677730273c9779569649929. These identities are deliberately distinct.

Actual provider execution

Stage	Job	Result
Validate and build public garden (rollback-v1.4)	107162348390	success
Deploy public garden	107163037033	success
Record separate deployment receipt	107163104292	success
Verify served revision and public routes	107163143536	success

The deploy log selected Pages artifact 10747521284, submitted pages_build_version=9da148f0488a1a22240d922dadc1b227e30d280f, returned deployment ID 9da148f0488a1a22240d922dadc1b227e30d280f, and reported success at 2026-09-23T11:37:00.2825686Z. Pages identifies the workflow revision; the exact served provenance separately proves the historical source.

Finalization downloaded the exact rollback provenance artifact and successfully reasserted the real deployment result at 2026-09-23T11:37:07Z. Its current-receipt creation and upload steps were intentionally skipped. No v1.6 build manifest or deployment receipt was invented for the historical v1.4 bundle.

Independently verified historical bytes

The consumer verifier source matches merged implementation d9059e36d07d959172ff2e8df7ed864b77435b81 exactly. The independent audit reran it against the downloaded provider site and the verified fixed historical Git checkout. Its report exactly equals the retained provider rollback.json, including source_checkout_checked=true.

The original known-good Pages archive 10741177073 was independently rehashed as sha256:3175c601487b61ecf4e87fc820a33ce8d3a137fa34bf21b2256d9868aa04257b and extracted safely for direct comparison. The new artifact preserves all 81 paths. Exactly 79 files remain byte-identical: 18 old Repository Intelligence files and 61 stable Quartz files. Only index.xml and sitemap.xml differ. Both parsed normalized feed digests match the fixed baseline; an additional independent raw-text comparison confirms that replacing only synthetic tag date text makes both feeds byte-identical.

Object	Exact SHA-256
Original complete 81-file historical deployment	sha256:1e92a0a74c154bbc3c339a6ef1764852bfcceba1a58b294e238b4a0331f94498
Actual new 81-file rollback composition (2,894,663 bytes)	sha256:a2762fb91e7e6907482ddf133d035865e07d70016ed6965d61f5155ce24f6bd1
Historical RI subtree, 18 files	sha256:c25caf4249cb4de83e5a747b02db4fa080df93385a0d7344899a5361831e7db9
Stable Quartz subset, 61 files	sha256:605507bc7780341bb519a0b9ff09e4dac9632214abf4407b95faf38ec9bbd6df
Actual uploaded Pages TAR	sha256:9c1e80b24e1542a4446f2f25e14ccad121a466e7a88f67a7f44e0167c7c519f1
Exact old public provenance	sha256:e1194cece9e63b0d904821e6810383ed6b968989098091b159df9649e25d70f3
Retained rollback report JSON	sha256:5dc2d38a889c4c4aaa729ae150b58b2a1196dfde8c78f3437188896bb7250228
Provider live report JSON	sha256:dd4b9114ef3c32e91423463cdf9f9e1b8e36565a957fec823f94a404c143d386
Independent direct live report JSON	sha256:5f2c563a49fcaea59fa7677485ec54fa9a35e8bf4db8fa2b67d4b7f41f2107f5

The public review ZIP, provenance ZIP site subtree, and actual uploaded Pages TAR contain exactly the same complete 81-file inventory. Archive extraction rejected traversal, absolute paths, duplicate entries, symlinks, and TAR special files. No private activity workspace, receipt, build manifest, or invented .nojekyll marker occurs in this historical public composition. Full-site equality with the original deployment is explicitly not claimed: the new composition digest records the actual runtime-date-bearing output.

Pinned source and input identities

• Relay: b71b090406a3a9e4cd9f107e9d14a623bbecb127 (v1.4.0).
• Quartz: 075afd3f712da0088a07f5284a7b3aba37dd61b6; unchanged Node 24 profile and UTC build.
• Quartz profile: sha256:11520d28fb34db72d60a32a5e17f19f327feb536015b584ef4d97697aff75fb1.
• Quartz configuration: sha256:2221600b76f7cb8c4021451feca88cb10abf52759fce95a832bf6b0bac1cc84a.

Normalized input	Original source SHA	Execution / availability	Exact SHA-256
osv	98778e8442d3be3ea7a3d1f62b71f33969346ecc	success / recognized-schema	sha256:8d9d499e7b31fef422901df19e2de563020c32e780af955e3fe6b24bd4431c68
megalinter	b44f798bb49259f9f48416b4ffebde1103e135c0	failure / recognized-schema	sha256:166e9eb2eed9693a34ca24f00d6217e13b0d05fbdebc821e943aa26336049aa7
scorecard	None	unknown / missing	None

Each nonmissing input and both Quartz files were independently matched to the exact historical Git blob. Report source identities remain original; no snapshot was relabeled. The input record binds workflow_dispatch, this exact run and attempt, and no producer trigger.

The sanitized publication report is below 8 KiB, contains only its allowlisted schema/identities/statuses, records publication_expected=true, and marks all 15 required build/publication stages successful. Its private-path, credential-like-value, and raw-payload exclusions were checked.

Artifact archives

All five new ZIP archives were downloaded and independently rehashed against GitHub metadata. Review/provenance/report/live artifacts retain 30 days; the Pages transport artifact retains one day. There is no current receipt artifact.

Artifact	ID	ZIP SHA-256	Expiration
empathy-composed-rollback-v1.4-9da148f0488a1a22240d922dadc1b227e30d280f-35855334498-1	10747805562	sha256:ac645a86af45c05f752659d62f40ca50d11f709ce4d30aa6120f686f40a5788d	2026-10-23T11:36:38Z
github-pages	10747521284	sha256:2e0627fe2d7559ca96b502f1d79d6fffaccd7cbcbf04391dcbae2076d0e20f4b	2026-09-24T11:36:41Z
empathy-live-35855334498-1	10747301346	sha256:28e1f539e9ce63b1b812dd5098afe728dd2e9b99b26b1bb1c37e4325e940a2f0	2026-10-23T11:37:29Z
empathy-provenance-rollback-v1.4-35855334498-1	10747078384	sha256:ae2137ee6248833d4e72193a6e26d70565e10f2fac6db51ef9d2c3cdd6968ed0	2026-10-23T11:36:40Z
empathy-publication-report-rollback-v1.4-35855334498-1	10746964111	sha256:ae8ca5ba210d3ef890f35e5abf15fddec3243a5303812c722ad2a2c4c10291ba	2026-10-23T11:36:43Z

Exact public rollback capture and restoration handoff

Provider live verification finished at 2026-09-23T11:37:29.133116Z, attempt 1. Independent direct verification finished at 2026-09-23T11:38:37.311534Z, attempt 1. Both verified the old provenance bytes before and after all 17 route probes. Each route returned HTTP 200 without following redirects and exactly matched retained historical HTML. A separate direct provenance download also matched sha256:e1194cece9e63b0d904821e6810383ed6b968989098091b159df9649e25d70f3.

Public route	SHA-256
/	sha256:64881d7fb759cb81b44ab9a7157caeb6f9cdc93440dc68b96d8a13981780b3ea
/dashboard.html	sha256:1acc33f50d8a458bd4ec02f11bccdc5f7bdfb13e6ed01d91c807e628d258dcc6
/projects/index.html	sha256:968d44627505c16db02cd96c36b5fcac3bdab4ed380d6d87ad62d6c97bcb6138
/projects/egohygiene-web-namespace.html	sha256:338fcd782fb64a4c6f94537ac480b75501ae609fcb9153f0738530ed73196916
/projects/repository-intelligence-dashboard.html	sha256:a0b36f4c98713ab7587c6185d24b76ede789a06b209b10409c44c7cf944d6e32
/intelligence/	sha256:75d44da67ce0ddbfe7e34b61d8f252aa1d87cf3e769e3521e8a4a22513e98c11
/intelligence/now/	sha256:df5675d84d6d5cebe1090f28e6cb843b26d5e3546309fa27f2816c4e58643822
/intelligence/roadmap/	sha256:d71152053dda17d46c3272bc4c4076e206c63c6d1fb68e159e6ec80c748211fe
/intelligence/decisions/	sha256:83f57c94558b61bc241a2b743a1a9371ab67cc6d2a68119479c0f1163b1de5c6
/intelligence/journey/	sha256:fe12e666a88dfebfb46f0697d8ed17442df9429e12dad209055f106ec8ffab2e
/intelligence/dependencies/	sha256:cc69732e65d10026033aacdc7cb5871f07531f2f33ebfd71d7f43da4ffa99d92
/intelligence/health/	sha256:85c5a342ab064299bd9067d68097a7d3654cae9b401cd765787fa3f86d8e3c53
/intelligence/releases/	sha256:f07effbf8ec418880454cb1dc0d9719da7be032c14cc4116f3c2d7c3808e070b
/intelligence/work/	sha256:059c9ac414bb5a7d37b17d4d85d7488f0ed646729f1469e752711481e1fb46be
/intelligence/search/	sha256:d850966375676591b7c5b83ec091593a6403710cfc3ce8d38a97eb4a8fd8855b
/intelligence/compare/	sha256:68e2ba6ffac7aaae96869c20e5cc2a08942d2180698d35b392e8baa98aea4415
/intelligence/dashboard/	sha256:3c9177e8ac8d5f16c1fe289dba490267eb23f1484d6b5e749be3e7fc2bf84ddb

The parent dispatched current restoration 35855661374 at 2026-09-23T11:37:58Z, immediately after completed provider route proof and its own direct old-provenance capture at 11:37:45Z. Independent rollback probing finished while that current build was running. This rollback audit confirms the restore run exists and is executing; successful restoration is a separate required proof and is not asserted here.

Restored-current proof will be recorded separately. Empathy #94 remains open pending repair PR #97 and its merged verification.

[szmyty]

The operational canary has now exercised default-branch publication, trusted failed-producer refresh, manual current, sanitized RIW-002 failure retention, and the fixed historical rollback. Current restoration run 35855661374/1 has deployed; final receipt/live artifact audit is in progress. Exact evidence is recorded in the preceding comments.

The first full main MegaLinter scan also exposed introduced findings missed by the PR fast profile: 62 Mypy diagnostics, 32 Bandit findings on fixed/guarded operations and fixtures, one synthetic Secretlint fixture, and three extracted-link failures. These are new validation regressions, not baseline-only failures; review found no demonstrated runtime exploit or incorrect publication.

Focused follow-up PR #97 is now draft at 40c83aef531f499de91d2b4da7900ff2d55ab749, tree 83cc7be8c2e6339b810538da88b3d8faab307bf0, based on verified live main 9da148f0488a1a22240d922dadc1b227e30d280f. It repairs those findings, adds canonical focused checks, and updates AGENTS/publication readiness guidance. Local 195 complete tests and 82 focused tests pass without skips; exact-head canonical consumer check 35855896816/1 passes. Full holistic feature-branch run 35856032526/1 is being audited before readiness.

Keep #94 open until #97 is reviewed, merged, and its exact merged default-branch publication/full-profile results are verified. Relay #33 and Relay #106 remain open. No unrelated scanner/dependency debt, Observatory read model, product polish, or fleet adoption is included.

[szmyty]

Empathy #94 restored current after rollback publication proof

Run 35855661374, attempt 1 completed success. Event workflow_dispatch; represented source 9da148f0488a1a22240d922dadc1b227e30d280f; exact tree f9684994bd89baa265a2407b0cab3293eefe6b5c. This report preserves that immutable deployment even if later commits advance main.

Provider execution

Stage	Job	Result
Validate and build public garden (current)	107163404346	success
Deploy public garden	107164438825	success
Record separate deployment receipt	107164521761	success
Verify served revision and public routes	107164581977	success

The deploy log selected Pages artifact 10748105066, submitted pages_build_version=9da148f0488a1a22240d922dadc1b227e30d280f, returned deployment ID 9da148f0488a1a22240d922dadc1b227e30d280f, and reported success. The separate receipt was recorded at 2026-09-23T11:41:42Z for github-pages, https://egohygiene.github.io/empathy/, conclusion success.

Independently verified inputs and output

• Exact pinned Relay owner and generator: 9a6315978766c336566b9fa7139b800fa8789ba5 (v1.6.0); owner source bytes checked against that Git object.
• Quartz pin 075afd3f712da0088a07f5284a7b3aba37dd61b6; profile sha256:11520d28fb34db72d60a32a5e17f19f327feb536015b584ef4d97697aff75fb1; configuration sha256:2221600b76f7cb8c4021451feca88cb10abf52759fce95a832bf6b0bac1cc84a. Configuration hashes rechecked against represented source.
• Manifest sha256:5c4e928e45ba680d457cfbe450e5c83ba6665e1ca447ce2058d69269d802e851.
• RI bundle sha256:ae76456fb5f1c9a20e4828b7ac1977ac93c8aa8eeb3b0080eb83426ef56279d1; 18 files, 2,254,914 bytes, plus validated manifest.
• Complete composition sha256:8683139188ce412627f653122c92f562c0fb595d05e03327ef60d5a7f37b0330; 82 files.
• All 63 Quartz files retained byte-for-byte: sha256:be6f7cb24c81bc9135f4346d8f3900981c410634d9856b7deae963e9b96712b7. Garden /, /projects/, /tags/ preserved.
• Actual uploaded Pages tar equals the retained complete composition inventory. Tar sha256:21ba5ff0184ed63ef52f9c6feabd650591ae5ad2b55056ebd3096348d03d65ee. No .nojekyll marker was added or assumed.
• Repeatability evidence confirms two Relay builds on the same prebuilt Quartz composition and checkout yielded identical inventories and manifest bytes; fresh Quartz builds and differently named checkouts remain outside this claim.
• Separate receipt JSON sha256:44ed115ff8fb16296876ae865f6f9197e9b696b7e89c31b2514f6c14c9953b31; reconstructed using the pinned owner at the receipt verification epoch and compared for exact equality. It binds this run/attempt, source, Relay pin, manifest, composition, deployment result, and fixed rollback identity. No receipt is public.
• Provider live report sha256:e8de60a7617031678c1e8f7ebbb9608f4990d5099d44b10fb919d7e2df295296; all 17 exact routes verified 2026-09-23T11:42:31.017022Z, attempt 3. Manifest checked before and after; redirects refused.
• Independent direct public verification also passed all 17 exact routes and identity checks at 2026-09-23T11:43:40.451658Z, attempt 1.

Normalized report inputs

Producer	Actual source revision	Execution / schema state	Summary SHA-256
osv	d9059e36d07d959172ff2e8df7ed864b77435b81	success / recognized-schema	sha256:95cee12101b4f42339856ae939265dcccafaaa1073507a4f7de2f5dfce5c5edb
megalinter	d9059e36d07d959172ff2e8df7ed864b77435b81	failure / recognized-schema	sha256:7b96fa1beed6245d08224c3a79c62e255b5d6b4243713ebaf19d938880d37efd
scorecard	None	unknown / missing	None

Input hashes were independently rechecked against represented Git source. Public producer states:

Producer	Availability	Execution	Findings	Freshness
megalinter	invalid	failure	unknown	unknown
osv	invalid	failure	unknown	unknown
scorecard	unavailable	unknown	unknown	unknown

The successful publication report is bounded allowlisted metadata, includes every required stage as successful and publication_expected=true; public unknown or invalid report evidence is not rewritten as green.

Artifact transport digests

All six ZIPs independently downloaded and checked against provider SHA-256 metadata. Archive paths reject absolute/traversal entries, duplicates, and links; Pages tar also rejects special files. Separate evidence retention is 30 days; the Pages artifact is one day.

Artifact	ID	ZIP SHA-256	Expiration
github-pages	10748105066	sha256:ff77cacd82321300f9230f5b3188f469842a5e80b2185e64ef7fdb2bc248cf5c	2026-09-24T11:41:14Z
empathy-publication-report-current-35855661374-1	10747816369	sha256:e021117473a4ba9a1989f5255cdad166550b8c4f090fa4525640e31bf44a6e9c	2026-10-23T11:41:14Z
empathy-deployment-receipt-35855661374-1	10747726709	sha256:4d734c50d781f1cee5559921c8bec42d875eb623423f438b1bb738e2e1cec078	2026-10-23T11:41:43Z
empathy-provenance-current-35855661374-1	10747631801	sha256:b929bf7ca26e1341a3b088c4a95561a035452104e25265e165d9b7c6dfd1c48a	2026-10-23T11:41:13Z
empathy-live-35855661374-1	10747576261	sha256:566bfa0084e1e2cd7f4b7c5b78d9d5e0d3dc4d33a854a922fd7c2c298cca62f6	2026-10-23T11:42:31Z
empathy-composed-current-9da148f0488a1a22240d922dadc1b227e30d280f-35855661374-1	10747556900	sha256:f16f5f53598f8dcd0b5595a4112d39c24aaaf8278f949475b12862c969c53be4	2026-10-23T11:41:12Z

Live route bytes

Every following route returned HTTP200 and exactly matched retained HTML. Identity URL /intelligence/build-manifest.json matched the manifest digest above before and after each full probe sequence.

Route	SHA-256
/	sha256:64881d7fb759cb81b44ab9a7157caeb6f9cdc93440dc68b96d8a13981780b3ea
/dashboard.html	sha256:1acc33f50d8a458bd4ec02f11bccdc5f7bdfb13e6ed01d91c807e628d258dcc6
/projects/index.html	sha256:968d44627505c16db02cd96c36b5fcac3bdab4ed380d6d87ad62d6c97bcb6138
/projects/egohygiene-web-namespace.html	sha256:338fcd782fb64a4c6f94537ac480b75501ae609fcb9153f0738530ed73196916
/projects/repository-intelligence-dashboard.html	sha256:a0b36f4c98713ab7587c6185d24b76ede789a06b209b10409c44c7cf944d6e32
/intelligence/	sha256:d5bb226079420bd84895c8a56668eff0ce9651d0cb631f813c6bfc48b1e38b3f
/intelligence/now/	sha256:036e98ddfe51509fe9710f5770fcab614b6776a9afe473f6bf58d899b2cf3cc2
/intelligence/roadmap/	sha256:b9f38779ba1cbb7fc9e17054e4a334611a3dcb39451a6de1f4b226b1a3dfec1c
/intelligence/decisions/	sha256:ac6afefd3f55386c6f9f2c2b34278f700d5e9e02b48d78d1f28b33e645f37b49
/intelligence/journey/	sha256:39b5585db3136329592036dccc953c3025a017fee691ea757b5da9fc089619e3
/intelligence/dependencies/	sha256:a89fad9c01965ee186c06d97c64a740b453e99d5942d55fdb6724d37efe71a87
/intelligence/health/	sha256:9c06466716a58c71bf24916e98886f6f80f225458d93d36e5829150b858bf616
/intelligence/releases/	sha256:d41a5fcb0969a2db19fe79f64b895d03b2615cd74850f72849dfb8094ffa7d7d
/intelligence/work/	sha256:1ad35badf56331330ae1be5b18e40f9c8bb33f7b4b9bbf06e3a8fd1362d35846
/intelligence/search/	sha256:0332c108ab777c9f957dd2730737a4e008f56ae702308cdcdb6005ad3d29f046
/intelligence/compare/	sha256:37e21ad614ad0b00f1173af07150bf86e2ad6ada1e3b31938bc896b02e43a40f
/intelligence/dashboard/	sha256:54880b611db01c3e21f96cbafb3e2519b7f24b87f515e0f2639639bcc26545d4

The restored current manifest and complete RI subtree are byte-identical to manual current run 35854445718 at the same source revision. Independent full-public-tree comparison found only index.xml and sitemap.xml differ, consistent with the explicitly retained Quartz runtime-date behavior. The restored full composition digest is recorded independently, without asserting whole-site equality across fresh Quartz builds.

Operational restoration is complete. Keep #94 open for repair PR #97 and its merged verification; Relay #33 and #106 remain open.