Close the exact-source to installed-artifact evidence chain

.github/workflows/ci.yml

@@ -14,9 +14,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Checkout pinned skill-lib authority
         uses: actions/checkout@v7.0.1
         with:
@@ -71,9 +73,43 @@ jobs:
           from tools._boundary_pytest import run_suite
           raise SystemExit(run_suite(["tests", "-c", "pyproject.toml", "--noconftest", "--strict-config"], Path.cwd()))
           PY
-      - name: Build package
-        run: .venv/bin/python -m build
+      - name: Build package from clean exact Git source
+        env:
+          EXPECTED_SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          test -z "$(git status --porcelain --untracked-files=all)"
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_COMMIT"
+          mkdir /tmp/ucns-build-source
+          git archive "$EXPECTED_SOURCE_COMMIT" | tar -x -C /tmp/ucns-build-source
+          .venv/bin/python -m build --outdir "$PWD/dist" /tmp/ucns-build-source
       - name: Check distributions
         run: |
           .venv/bin/python -m twine check dist/*
           .venv/bin/python tools/verify_distributions.py . dist
+      - name: Replay exact wheel and source distribution in clean environments
+        run: bash tools/replay_distributions.sh . dist /tmp/ucns-replay python
+      - name: Collect exact artifact replay evidence
+        env:
+          EXPECTED_SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          mkdir -p /tmp/ucns-evidence/artifacts /tmp/ucns-evidence/replay
+          cp dist/*.whl dist/*.tar.gz /tmp/ucns-evidence/artifacts/
+          (cd /tmp/ucns-evidence/artifacts; sha256sum -c /tmp/ucns-replay/archives.sha256)
+          cp /tmp/ucns-replay/*.json /tmp/ucns-replay/*.xml /tmp/ucns-replay/archives.sha256 /tmp/ucns-replay/dependencies.txt /tmp/ucns-evidence/replay/
+          python - <<'PY'
+          import json, os, pathlib, subprocess, sys
+          def git(*args):
+              return subprocess.check_output(["git", *args], text=True).strip()
+          if git("status", "--porcelain", "--untracked-files=all"):
+              raise SystemExit("checkout changed before provenance capture")
+          if git("rev-parse", "HEAD") != os.environ["EXPECTED_SOURCE_COMMIT"]:
+              raise SystemExit("checkout no longer matches the selected source commit")
+          record = {"source_commit": git("rev-parse", "HEAD"), "source_tree": git("rev-parse", "HEAD^{tree}"), "python": sys.version, "node": subprocess.check_output(["node", "--version"], text=True).strip(), "authority": "execution evidence; independent receipt and source verification required"}
+          pathlib.Path("/tmp/ucns-evidence/source.json").write_text(json.dumps(record, indent=2) + "\n")
+          PY
+      - name: Retain artifacts and replay receipts
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: ucns-evidence-${{ matrix.python-version }}
+          path: /tmp/ucns-evidence/
+          if-no-files-found: error

README.md

@@ -177,6 +177,26 @@ Exact modular and trace records require immutable tuples with non-Boolean intege
 residues; prefer the public builders. MPFR rational constructors accept only
 integers or `Fraction`, and NaN cannot participate in interval ordering.
 
+To replay both exact distribution files after the archive gate, with no editable
+installation or source-path dependency:
+
+```bash
+bash tools/replay_distributions.sh . dist /tmp/ucns-replay python3.12
+```
+
+The output directory must be new and outside this checkout. The script exports
+hash-locked dependencies, installs the wheel and sdist into separate clean
+venvs, and runs all geometry tests against each installed package. Its receipt
+records artifact hashes, Python versions, loaded package paths, test counts,
+and zero skipped checks. It also binds a selected exact-input receipt executed
+from the archived source, whose UCNS hashes must match both installed artifacts.
+CI repeats this on Python 3.10, 3.11, and 3.12 against the exact PR head. Each
+job retains its wheel, source archive, dependency export, test reports, selected
+receipt, and replay receipt in `ucns-evidence-<python-version>`. The accompanying
+`source.json` binds the Git commit/tree and runtimes. Download those bundles
+from the workflow run and verify their artifact/receipt hashes and source maps
+before accepting the chain; a successful Actions job alone is not acceptance.
+The source archive includes this replay script and the exact build-tool pins.
 The no-exec graph also reconciles both exact vendored reference parsers, with
 local Python and TypeScript numeric-field/no-execution witnesses. The complete
 repository evidence suite requires Node 24.15.0 for that TypeScript check; UCNS
@@ -260,3 +280,7 @@ checks; it is not a sandbox for hostile test code. A `passed` receipt covers onl
 checks; it does not select geometry, ratify candidates, or establish freshness.
 
 `hmmm`: ratification of the modular-orbit / continuum-boundary-trace candidates, the complete higher-dimensional UCNS construction, the exact visible-circle wave-trace lift into the native Möbius carrier, any law selecting one continuum covering lift from a finite modular congruence class, and the exact geometric operation of every Public Gonol function position remain unresolved. Unresolved geometry stays unresolved; semantic machinery is not used to fill it.
+
+Distribution replays hash the complete extracted tree before and after each full suite, reject persistent source changes, and retain the full source map. Each installed distribution inventory covers package files, dist-info payloads, and validated uv installer metadata/RECORD; imports remain separately witnessed. Check downloaded archives from their directory with `sha256sum -c ../replay/archives.sha256`. These checks establish execution provenance, not scientific ratification.
+
+Standalone replay requires uv 0.11.18. It verifies the bootstrap version, synchronizes the verification environment from the hash-locked export, uses that environment’s uv for later installation, and retains both executable identities. Fixture source builds consume the same locked dependency export. Optimized Python mode is rejected before evidence can be produced.

docs/work-graphs/repository-plan-report.json

@@ -9,10 +9,10 @@
     "blob_sha": "9b347b2dff7692054b571602f30ee6d00c2e7265"
   },
   "source": {
-    "branch": "repair/ucns-audit-20260911",
-    "commit": "af02fa61c225b2ada4cb36d1c8016fc81f94f1c0",
+    "branch": "evidence/clean-install-final-20260912",
+    "commit": "61d329b851952bbc0fec5eca782c8fd05dcc82d2",
     "generated_at": "2026-09-12",
-    "note": "Describes the exact implementation commit preceding this report-only refresh. Maintenance PR #226 is in final exact-head review; merge remains a separate acceptance observation. No scientific or deployment authority is transferred."
+    "note": "Describes the exact implementation commit preceding this report-only refresh. Artifact acceptance requires inspecting the hash-bound replay bundle for the selected source identity; job success alone is not acceptance. No scientific or deployment authority is transferred."
   },
   "authority": {
     "owns": [
@@ -38,7 +38,7 @@
     }
   },
   "status": {
-    "state": "active geometry repository; maintenance repair in exact-head review",
+    "state": "active geometry repository with an exact artifact replay chain",
     "current_claim": "UCNS retains exact geometric carriers and candidate modular/wave relations. Local repairs harden immutable/exact inputs, MPFR NaN ordering, no-exec contract auditing, selected-check receipts, and replayable distributions; no candidate is ratified by those repairs."
   },
   "delivered": [
@@ -71,20 +71,25 @@
       "surface": "Source distribution replay inputs and artifact gate",
       "status": "implemented exact wheel/sdist metadata and directory validation with pinned build backend and source replay inputs",
       "boundary": "archive presence and matching bytes are packaging evidence; archived certificates are not thereby recomputed"
+    },
+    {
+      "surface": "Clean wheel and source-install evidence chain",
+      "status": "implemented 159-test artifact replay on Python 3.10, 3.11, and 3.12 with hash-locked dependencies, full source snapshots, complete installed-distribution inventories and retained installer metadata, archived-source exact-input receipts, and portable CI bundles",
+      "boundary": "each receipt binds its own exact artifact and source identity; Python/Node execution and passing packaging evidence do not ratify geometry or grant publication/freshness standing"
     }
   ],
   "active_frontier": [
-    "close exact-head maintenance review and then verify the source-distribution/clean-install replay chain across supported Python versions",
+    "inspect and accept the exact artifact replay bundle for each selected source identity across supported Python versions",
     "reconcile the intrinsic/extrinsic Structural Null representation before constructing an origin attachment",
     "derive the complete visible-circle wave trace into the native frame-bearing M\u00f6bius carrier",
     "ratify or reject modular-orbit / continuum-boundary-trace candidates under explicit falsifiers",
     "resolve higher-dimensional recursive-scale laws and geometric operations for unresolved Public Gonol positions"
   ],
   "next_actions": [
     {
-      "action": "Complete exact-head review and Python 3.10/3.12 CI for UCNS PR #226; merge after all live findings and gates close",
-      "owner": "The-Interdependency/ucns maintainers",
-      "dependency": "Exact canonical skill-lib 5e7239b52dc5403d8d01fbc63341fe397719ec3f binds the declared parser; nine installed skills pass strict drift verification"
+      "action": "Verify artifact hashes, source maps, dependency exports, and selected receipt identities from each supported runtime bundle before accepting the evidence chain",
+      "owner": "The-Interdependency/ucns evidence maintainers",
+      "dependency": "accepted exact source and skill-lib pins; no acceptance from Actions status alone"
     },
     {
       "action": "Correct stale stack research claims about PR #220 and reconcile its exact research base before consuming results",
@@ -113,7 +118,6 @@
     }
   ],
   "blocked": [
-    "Final exact-head CI and merge remain unobserved at this report refresh.",
     "Origin attachment and recursive traversal cannot be supplied by numerical defaults or downstream interpretations."
   ],
   "cross_repository_relations": [

pyproject.toml

@@ -23,6 +23,10 @@ classifiers = [
 [project.optional-dependencies]
 test = [
   "pytest>=9.1",
+  "build==1.5.0",
+  "setuptools==84.0.0",
+  "wheel==0.48.0",
+  "uv==0.11.18",
   "tomli>=2; python_version < '3.11'",
   "mpmath>=1.3,<2",
   "sympy>=1.12,<2",
@@ -31,7 +35,7 @@ research = [
   "mpmath>=1.3,<2",
   "sympy>=1.12,<2",
 ]
-build = ["build>=1.2", "twine>=5", "tomli>=2; python_version < '3.11'"]
+build = ["build==1.5.0", "twine==7.0.0", "setuptools==84.0.0", "wheel==0.48.0", "tomli>=2; python_version < '3.11'"]
 
 [tool.setuptools]
 package-dir = {"" = "src"}