admission: bind Flow 1.35.1 to measured reference evidence

[abrichr]

Register the matching release admission for published Flow 1.35.1 and append its release and synthetic workflow references to the canonical ledgers.

The admission binds source 44e99a48ebf048c18892aa17cef6ae594db0d0c2, wheel sha256:cfbc89acc6a2e3bcb5502a4d1fb29e985a03149a7f14c32c259254676bb3f11d, and sdist sha256:c5c6c437472b23999223b0d2473dbf21de2ca05274c270ae3854adeda6b07dca. The existing issuer checks the complete measured evidence chain and current authority before consumption. Release sequence 2 preserves the prior admission identity; every new nested evidence reference names its actual containing commit.

The reference campaign has 18 groups across six conditions, one exact synthetic bundle, and 831 retained artifacts. Primary outcomes are 12 VERIFIED, three HALTED_BEFORE_EFFECT, and three RECONCILIATION_REQUIRED. Native model-call counts are zero; external network-call counts remain unknown. Customer workflow admission and product-wide Production require their separate gates.

The existing already-published-pypi path binds the published bytes and actual tag controls. GitHub release 385710075 retains immutable:false. No historical signed object or prior ledger row changes.

The repository evidence guide now separates the published-wheel qualification from the historical September 8 study. Snapshot tests retain the original seven release and workflow objects, derive the latest registered Flow identity, and use a deterministic test-only clock. Runtime validators and refusal/expiry tests are unchanged.

The release admission ID is sha256:279d6e0a9728be2d6466106b07a23a45cb6dd8acf0c4f4bcc2047d09468cabb1. Its object sha256:0edd19d51d449e3eaba21463117fb19148553a817e03c8c5b804953a26bcbb51 and bundle sha256:114c70ce18f6633b0a2b9c4b7b274e8f7484e711a102f182cf3d1f417ec74910 were committed and pushed at 2ed288e8bd47dd1809f883cc75e3f5ce34348692 before the ledger reference was constructed. The merge must preserve that commit.

The workflow ledger preserves its exact original main reference at f0fb9cc812c0d1653b1ec2998749b078f244308e. The consumer now accepts the signed 1.35.1-reference.1 bundle version under the existing canonical syntax and length rules. It retains the evidence-class, digest, signature, authority, expiry and privacy checks; only the obsolete 0.0.0-synthetic equality was removed.

Independent reviews cover each plan, signed pair, one-use result, registry delta, final ledger references, documentation and consumer correction. All 337 canonical unit tests pass, including actual signed old/new workflow rows and malformed-version, identity-digest and byte-binding refusals. Both ledger history checks pass. Current canonical verification against the merged ledger and exact downloaded artifacts remains the consumer's required boundary.