Demo refresh: verify on the front door, sealed sample package, platform-independent bytes - #5
Merged
Merged
Conversation
… full package READMEs (EN+FR) gain the 'verify a delivered assessment' section: the package contents, the offline balise verify checklist with the verdict ladder, a pointer at the sample engagement, and the seals in two sentences with their honest claims (when from the anchor, who from the signature, fingerprint published in docs/SIGNING.md). generate.py now runs the sealed-era pipeline: pages staged with a retrieval timestamp (the fixture file is the artifact examined), write_report with the snapshot (source references + content-addressed evidence archive), and the manifest written last, with the seal step printed as the operator's next move. Demo outputs themselves are NOT regenerated in this commit - that run needs the semantic key and lands separately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The showcase engagement now carries everything the pipeline ships: assessment id in genesis and both report headers, producer provenance with the live engine, source references on every examined finding, the content-addressed evidence archive (3 files, exact set), the manifest written last, and a genuine OpenTimestamps anchor accepted by all four public calendars (pending; upgrade to a Bitcoin block with balise seal --upgrade after a few hours). balise verify on the committed package: SELF-CONSISTENT with every checklist line green. Verification-trail naming now current throughout the deliverables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A fresh checkout was CRLF-converting the committed package, breaking every content-addressed seal (evidence names, manifest bytes under the anchor, artifact hashes) - balise verify on a clone said ARTIFACT-DIVERGED. Proven by checkout simulation, fixed with -text, re-proven green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…hored Every package writer pins newline='\n': content-addressed seals hash shipped bytes, so a Windows-run pipeline must produce the same package as any other platform (test: no CR in rapport/trail/manifest). The previously committed demo was written in platform text mode (CRLF) and git normalized the blobs to LF at commit, so a fresh checkout could never match its own manifest - proven by simulation (ARTIFACT-DIVERGED on checkout), now impossible by construction. Demo manifest rebuilt over the byte-stable artifacts (findings and trail untouched, same assessment id and head) and re-anchored; balise verify on the exact committed bytes: SELF-CONSISTENT. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the LinkedIn-readiness P1/P2 items.
balise verifychecklist and verdict ladder, the seals in two honest sentences, and a pointer at the sample engagement.seal --upgradegrafts the Bitcoin attestation in a few hours)..gitattributes: the package passes through git byte-exact — checkout simulation proved CRLF conversion was breaking every content-addressed seal on a fresh clone (ARTIFACT-DIVERGED).newline="\n"(test: no CR in shipped files) — content-addressed seals hash shipped bytes, so a Windows-run pipeline must produce the same package as any other platform. Demo re-manifested and re-anchored over the stable bytes; findings and trail untouched.balise verifyon the exact committed bytes:SELF-CONSISTENT, every line green.Suite: 71 green.
🤖 Generated with Claude Code