fix: harden v0.4.1 integrity contracts

[thomaswillner]

Problem

Claude Opus 5 found eight integrity/conformance gaps in v0.4.0: three divergent target identities, offline publication overclaim, readiness criterion drift, weak G3-G5 independence admission, truncated state roots, incomplete snapshot-less limitations, ambiguous licence scope, and a silent pre-corpus digest skip.

Changes

• separates immutable normative source target from metadata-only packaging/release commit;
• binds publication and adapter conformance to source commit ae9018c5d464b8ddd0fdf2ac99577e5e7fdc562b and digest fc2be2c194c801349c4e39462394b6e1e52b2e479619b68a5615e7386bfdf5b9;
• scopes offline publication output and adds remote-required/tag-time inconclusive checks;
• enforces all ledger/matrix criteria and gate-specific G3-G5 independent evidence;
• widens receipt/checkpoint state roots to full SHA-256;
• discloses state-root non-binding for all snapshot-less adapter paths;
• clarifies Specification Materials and trusted-code-only binding execution;
• fails explicitly for pre-corpus targets and digest-binds the complete corpus;
• preserves NOT_PROD_READY; G2-G6 remain BLOCKED.

Evidence

• make check: PASS; 25 repository checks, 25 claim guards, readiness/publication guards, 375 tests, expected fail-closed demo.
• make links: two expected pre-release 404s only (v0.4.1 compare/release URLs); rerun required after release publication.
• working and committed source digests match.
• post-target diff contains only publication/active-surfaces.json and spec/adapter-conformance.json.
• corrected public target: Independent review requested: novelty, conformance, and security boundaries #4 (comment)

Known limitations

This patch adds no external reviewer, production cryptography, second adapter, third-party validator, three-system experiment, or operational certification. Candidate Python bindings remain trusted-code-only unless separately sandboxed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da088a2253

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".