feat(intelligence): 🧾 prove Empathy publication boundaries

[szmyty]

Refs #94
Refs egohygiene/relay#33

Empathy needs reviewable evidence connecting its Repository Intelligence build to the complete Mindgarden/Quartz composition and eventual Pages deployment. This PR upgrades both current integrations to reviewed Relay 9a6315978766c336566b9fa7139b800fa8789ba5 and adds the consumer publication checks while preserving Empathy as the sole Pages authority.

• Preserve the reviewed-public Mindgarden projection, Quartz 075afd3f712da0088a07f5284a7b3aba37dd61b6, and existing normalized-report producers. Trusted default-branch producer refreshes retain useful non-success conclusions; PR origins cannot enter that privileged path.
• Build current and fixed rollback-v1.4 compositions on PRs and retain 30-day review artifacts. PRs have no Pages upload, deployment, receipt finalization, snapshot publication, or secrets path.
• Verify duplicate Relay builds, exact manifests, the complete composition, and preservation of every Quartz file. Keep original report identities; missing or incompatible evidence remains unknown/invalid.
• Isolate deployment permissions in Empathy's deploy job, retain deployment-specific receipts outside deterministic output, and verify exact served identity and route bytes after trusted deployments.
• Add bounded public-safe diagnostics, intentional RIW-002 failure workflow, real provider scheduling fixtures, strict YAML/JSON checks, safe XML rollback validation, and AGENTS/publication guidance. The focused check now uses the same canonical Ruff policy as MegaLinter.

Reviewed identity	Value
Branch	agent/prove-repository-intelligence-94
Head	9916165cd6e20ce1186a62b7d2f25333e33be1b5
Tree	792b4a86e83a7cafb99342a4489285a3d7fe8997
GitHub represented PR merge	3e4e05412ef8311fb0b0d61380255536a818186b
Verified base	09cefdb4a8c808d2dcceddb54ab6a27004eded2e

The represented merge and reviewed branch have the same tree. A normal merge incorporated the producer-owned report refresh that advanced main during implementation.

Final provider/artifact evidence records exact run attempts, all ten independently verified archive hashes, manifest/bundle/composition digests, report input identities, and rollback proof. Current and rollback Pages builds, standalone RI, 81 consumer tests, scheduler checks, MegaLinter, CodeQL, commit validation, dependency review, and lint-architecture generation passed on this head. Both PR Pages uploads and all deployment jobs were skipped.

Complete validation and trust-boundary review records 194 local root tests without skips; the full garden suite; architecture, lifecycle, continuity, roadmap/journal, and automation validators; canonical lint, syntax, duplicate-key, and diff checks. All 63 Quartz files remain unchanged in the 82-file current composition; standalone output matches its intelligence subtree.

Repository CI is not wholly green: automation reaches the pre-existing EgoLint catalog/workflow pin mismatch, and OSV finds the same 85 blocking findings in unchanged dependency inputs. The local complete-suite attempt also records existing stale task-catalog entries and the missing Cargo workspace fixture. Those unrelated defects remain outside this checkpoint.

Actual default-branch/manual/producer deployment, deployment receipts and live routes, dedicated RIW-002 failure retention, operational rollback, and immediate restored-current proof require merge and consumer-side execution. The documented sequence remains acceptance work on #94. Relay #33 and #106 remain open. Observatory-dependent views intentionally remain unavailable without a commit-matched read model. Checkout-directory portability is separately tracked by Relay #109; repeatability here is scoped to the declared CI context.

This PR is ready for review and has not been merged.

[szmyty]

Validation completed against exact head 9916165cd6e20ce1186a62b7d2f25333e33be1b5, tree 792b4a86e83a7cafb99342a4489285a3d7fe8997, with reviewed Relay 9a6315978766c336566b9fa7139b800fa8789ba5 and unchanged Identity pin 481e284a77e0a7cc3bf25f40dc91a71120d036ef.

• Full local root suite: 194 passed, zero skips, including the 81 focused consumer/publication checks and all six Identity integration checks.
• Full garden contract: 23 Mindgarden, 5 Obsidian, and 4 publishing tests passed; five-note validation, one context pack, and deterministic reviewed-public projection passed.
• Architecture: 5 passed. Automation policy: 20 workflows and 11 actions passed.
• Canonical Ruff 0.16.5 lint and format: all eight changed Python files passed, using egolint/.config/lint/python/ruff.toml. Actionlint 1.7.12 passed all workflows. Markdownlint 0.49.1 passed all five changed Markdown files using .markdownlint.json.
• Syntax: 37 YAML and 9 JSON contracts parsed with duplicate-key rejection, intentional duplicate fixtures rejected, eight changed Python files, 30 inline Bash blocks, and two Python heredocs validated. No JavaScript implementation changed. Full PR git diff --check passed.
• Reviewed Relay lifecycle, continuity, architecture, journal runtime, and action catalog validators passed at the same immutable Relay revision. Earlier unchanged Mantle baseline: 718 passed, 16 platform/tool skips, zero failures; temporary-prefix installation smoke passed.

Fresh exact-head provider evidence (all attempt 1):

Workflow	Result and evidence
Consumer checks 35850394025	Success: canonical Ruff lint/format and 81 tests, zero skips. Artifact 10745376174.
MegaLinter 35850393985	Success, including the previously failing Ruff and Markdown checks. Report retained; PR snapshot publication skipped. Artifact 10745576183, downloaded ZIP verified as sha256:8639f69fd6ec85c79e280d1098d9363dc23aacbd575242a9a59d1452d9cd4ad2.
Automation 35850394085	Root tests pass (183 run, 17 expected owner/Identity skips); the only failure is the unchanged EgoLint catalog/workflow pin assertion. The dedicated consumer job and local suite cover those owner paths without skips.
OSV 35850394078	Existing severity gate: 85 blocking findings (4 critical, 81 high). All 167 finding identities exactly match the baseline; all 49 dependency/SBOM inputs and the workflow are unchanged. Artifact 10744859612, downloaded ZIP verified as sha256:deb82bcd4842db03313a0403658aa109a8041408a75e9746f84a809b44f6abfd.

Existing baseline defects remain explicit: EgoLint is 30/31 because its catalog expects MegaLinter 15e5b455… while the workflow uses 9949bad0…; TASKS.md retains pre-migration Identity commands; the root Cargo workspace references missing tests/fixtures/clippy/Cargo.toml, preventing Beacon Rust gates. The Task graph itself parses. Optional Mantle Fish/ShellCheck/shdoc/shfmt checks were unavailable. No new provider failure was found.

Identity output was generated only in an isolated test checkout and kept out of Repository Intelligence composition inputs. These checks do not claim post-merge deployment, live-route, intentional provider failure, rollback deployment, or restored-current acceptance.

Local log SHA-256 digests:

Log	SHA-256
actionlint.log	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
architecture-task.log	890bd3cc0e61b42d082307d819db0370cb7ca700a4a248d8665268f63fe75884
automation-policy.log	e28ae3f3f118f38ae9d334ce26b4082cd1f4b94d8d3d71929b386b2fc7140d80
egolint.log	bed55efed0f6ed639e7723407b71b2557c91dde55c1c93c7989a360411711da7
garden.log	16166522ea77f72be01ee41e95e46c91f6e61561f93470e9a60e9fafe9a6306f
markdownlint.log	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
root.log	3b30886dbdae0f1342d8f6bfcb7ee043507d02aca936e6d36012a7c5360cc4ef
ruff.log	86919562e2ae6ea7ddce8a931e1b779def6cacde6c60fe198ef40c34660bc7fe
syntax.log	19fa26ca1ac721067409824bfe769030c93591b2c9cd0e6f7432b968f1a5faa7

Independent source review found no blocker in the publication trust boundaries. Only Empathy's separate deploy job receives Pages/OIDC write permissions; the build, receipt, live verification, standalone, and safety-fixture jobs use read permissions. PR lanes retain review evidence and cannot enter the snapshot publishers or privileged producer-refresh path. Producer guards require an allowlisted workflow/event, both repository identities, and the default branch while deliberately preserving useful non-success conclusions. Remote actions remain commit-pinned, the Quartz pin and reviewed-public Mindgarden projection remain unchanged, and Relay is constrained to the intelligence subtree.

Receipt validation, tamper rejection, failed-deployment semantics, exact live-byte mismatch detection, safe diagnostics, duplicate-key rejection, and encoded XML declaration rejection are exercised by fixtures. The provider scheduling fixture exercises a real skipped ancestor and observes the copied publication guard outcomes. Cancellation and fork-origin cases are predicate/fixture coverage; no actual cancelled deployment or fork dispatch experiment is claimed. Operational deployment receipts and live publication proof remain post-merge acceptance.

[szmyty]

Reviewed branch agent/prove-repository-intelligence-94, head 9916165cd6e20ce1186a62b7d2f25333e33be1b5, tree 792b4a86e83a7cafb99342a4489285a3d7fe8997. PR #95 has not been merged.

GitHub associates every run below with that exact PR head. The generated artifacts represent synthetic PR merge 3e4e05412ef8311fb0b0d61380255536a818186b. Its parents are base 09cefdb4a8c808d2dcceddb54ab6a27004eded2e and the reviewed head; its tree equals the reviewed head tree. The head and represented merge identities are deliberately recorded separately.

Workflow / attempt	Verified result
Publish Mindgarden 35850394210 / 1	Both current job 107146425746 and rollback job 107146425508 succeeded. Current duplicate build and non-clobber checks, and fixed historical rollback verification, all executed successfully.
Standalone RI 35850394115 / 1	Job 107146425039 succeeded; only public bundle and sanitized report retained.
Consumer checks 35850394025 / 1	Canonical Ruff 0.16.5 lint/format, 81 tests with zero failures/errors/skips, 31 YAML and nine JSON files with duplicate-key rejection, Python compilation, and diff checks passed.
Scheduler fixture 35850394035 / 1	Actual skipped ancestor followed by successful build/deploy/finalize/live no-ops. PR publication, failed-build, and cancellation predicates denied their fixture lanes; expected and observed job results match.

For both real Pages build lanes, Configure Pages and Upload Pages were skipped. Deploy job 107147582896, receipt finalization 107147583487, and live verification 107147584127 were skipped. The run has six review/provenance/report artifacts and no github-pages artifact. These PR runs did not deploy the site or create a deployment receipt.

Eight Pages/standalone ZIP archives were downloaded and independently rehashed here. The safety reviewer independently downloaded and rehashed the two small checks/scheduler archives. All ten match GitHub's advertised digests. Extraction rejected traversal, absolute paths, duplicate entries, and symlinks.

The complete current public artifact exactly matches the site retained with provenance. The standalone's 19 public files (18 payload files plus manifest) exactly match the composed site's RI subtree. The pinned Relay implementation independently revalidated the manifest, payload inventory, routes, source identity, and full composition. All 63 captured Quartz files remain byte-identical after RI composition; every baseline file hash was checked. Run evidence and receipts stay outside the public tree; no raw activity workspace or invented .nojekyll marker is included.

Current deterministic evidence	Exact digest
Manifest	sha256:5c190ce5aaa454a1e1736bd1581ff5c5bf2a36bb1d8c869b23536132248de21c
RI payload, 18 files / 2,254,914 bytes	sha256:2fd15bdaa3cb5992abcdd1fd5828e4e9cc1c39d2afa6112b363b529bdd10159e
Complete current composition, 82 files	sha256:5901a0878c048789067448f90d6fd0711b71c684a1ae106258a32094e865f9dc
Preserved Quartz baseline, 63 files	sha256:f0f381eed36ecd73953f1b72df20d9829357b668174870ae8d132f0fe44986c8

determinism.json records equality between the two Relay builds on the same prebuilt Quartz tree and checkout; its complete site digest, manifest digest, and 82-file count were recomputed. The reviewed Relay pin is 9a6315978766c336566b9fa7139b800fa8789ba5 (v1.6.0). Quartz remains 075afd3f712da0088a07f5284a7b3aba37dd61b6.

The exact source Git blobs independently match the profile/configuration and normalized-summary digests recorded in inputs.json. Its consumer SHA/tree matches the represented merge. OSV and MegaLinter retain their original scanner revisions: their public projections remain invalid with unknown findings/freshness because those revisions do not match the represented source. Missing Scorecard remains unavailable/unknown. Neither input identities nor failed evidence were rewritten into green data.

Rollback independently validates old source 254185272ab27b6858b8b0393af6549c205c9a8d, tree a5cdaba679c8c0b9d677730273c9779569649929, and old Relay b71b090406a3a9e4cd9f107e9d14a623bbecb127 (v1.4.0). The checker was rerun against the downloaded artifact and a verified historical Git checkout. Public and provenance artifact copies match.

Rollback evidence	Exact digest
Actual provider rebuild, 81 files	sha256:b49b0793c6f3bdc82a441210f370ea6f1dd02c60417a198333d93a0643c03b99
Historical RI, 18 identical files	sha256:c25caf4249cb4de83e5a747b02db4fa080df93385a0d7344899a5361831e7db9
Historical stable Quartz, 61 identical files	sha256:605507bc7780341bb519a0b9ff09e4dac9632214abf4407b95faf38ec9bbd6df
Original deployed complete site	sha256:1e92a0a74c154bbc3c339a6ef1764852bfcceba1a58b294e238b4a0331f94498

The rebuilt composition preserves all 81 historical paths. Only synthetic tag dates vary in the two normalized XML feeds; the other 79 files match historical bytes. The report records the new composed digest separately and makes no false whole-site equality claim. Old public provenance remains old; no current-generator manifest is invented.

Current, rollback, and standalone diagnostic reports each remain below 8 KiB, contain only allowlisted identities/outcomes, and record all required stages as successful. They contain no private filesystem roots, raw producer payloads, job outputs, or credential-like values. PR reports explicitly record publication_expected: false. Artifact retention is 30 days. The independently checked safety reports are 356 and 988 bytes.

Artifact	Independently verified ZIP SHA-256
Current public composition — 10744524313	sha256:9096f253b84a2cdbcd15b7e478567f3ebb3bb5a16bee3af703d140c719fc5eef
Current provenance and inputs — 10744274683	sha256:78bc8335462e63aacbe1e79d3b252f1d167779acddacea1f1d0ba66b82ee0086
Current sanitized report — 10744349693	sha256:80af126001acdc08e4fcf91511553947fb4ed96980193640b126178f00bba691
Rollback public composition — 10745476227	sha256:054cd2ff8533bc8ee964dd22c371f533e2631f3be8ad0c69862512d7718155bc
Rollback verification and inputs — 10745124215	sha256:2e81de392b8f46aa35db9e282727365ebeb7c9803d45537442bc06c99e0063fe
Rollback sanitized report — 10745486252	sha256:d341e0ed998aa3c1fc01a91729664c5666c067b5d92429d0c32e6cf1b45c8793
Standalone public bundle — 10744829968	sha256:fb9575b6983a0b3f66fcadf53210813679329fb20d3ce0a0b97a998a0cff9664
Standalone sanitized report — 10745381374	sha256:5b0c1e26f8c44b63c093dffa67cd24c1140bc62bb4bcb34e5b9f333f80f9ecf2
81-test contract report — 10745376174	sha256:aea90d79d3d020fc0697af17a9ff7608890af6369cb5f79420d99f41bc5d46c8
Provider scheduler report — 10744994337	sha256:c6943c9b772d971a6573dbd4f4e7b8ae97dc5ef0710bf299188939549daa876b

• This proves same-context duplicate Relay builds against one prebuilt Quartz input. It does not claim fresh Quartz builds are byte-identical or arbitrary checkout-name portability; the latter remains Relay #109.
• Real deployment receipts and live-route evidence are intentionally absent from PR runs. Receipt success/failure/tamper behavior is covered by the pinned-owner fixtures; provider deployment and receipt finalization still require a merged trusted consumer run.
• Post-merge default-branch publication, manual current, a trusted producer workflow_run refresh preserving useful non-success evidence, intentional RIW-002 failure dispatch, live rollback, and immediate restored-current evidence remain required for acceptance on Empathy [Relay #33.4] Prove Repository Intelligence publication in Empathy #94. Relay fix(lint): format mega-linter.yml and add prettier pre-commit hook #33 and #106 remain open.
• The scheduler fixture proves actual skipped-ancestor scheduling and copied predicate behavior. It is not an actual cancelled deployment or fork-dispatch experiment.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress