Register raw microdata releases as source artifacts: licence/access fields, hash-only registration, first UK registrations (#221) - #227

Open

MaxGhenis wants to merge 214 commits into

mainfrom

microdata-registration

Commits on Sep 4, 2026

Add one shared chronicle-first env helper

MaxGhenis
and
claude
committed
d9c3199
Make R2 buckets configurable and emit chronicle.db

MaxGhenis
and
claude
committed
e2e0af0
Add hermetic tests for the rename window

MaxGhenis
and
claude
committed
de03d37
Document the rename window and the bucket cutover

MaxGhenis
and
claude
committed
08d950b
Pin the boundary guard against the bucket rename

MaxGhenis
and
claude
committed
d032ec5
Isolate the rename window for every test, not one module

MaxGhenis
and
claude
committed
b8d717d
Refuse to attach a recorded R2 URI to different bytes

MaxGhenis
and
claude
committed
5cb357a
Document publisher revisions alongside the bucket rename

MaxGhenis
and
claude
committed
58706dd
Record the gate round-1 fixes in PROGRESS.md

MaxGhenis
and
claude
committed
0e7e095
Read the recorded object's identity from its URI too

MaxGhenis
and
claude
committed
83b8ba0
Pin the preserved block's field order too

MaxGhenis
and
claude
committed
45b7d25
Say what the reproduction actually ran

MaxGhenis
and
claude
committed
8cf2886
Record the round-2 gate findings and the corpus scan

MaxGhenis
and
claude
committed
c074341
Reject the chronicle spelling of the derived-row marker

MaxGhenis
and
claude
committed
5e41b75
Let CHRONICLE_SCHEMA configure the mirror writer, at call time

MaxGhenis
and
claude
committed
fa4a82f
Address the manifest a fetch is actually revising, and read it strictly

MaxGhenis
and
claude
committed
e68fdd0
Document identity, manifest selection and locator checks

MaxGhenis
and
claude
committed
ad828b1
Name the strict storage reader for the pair it belongs to

MaxGhenis
and
claude
committed
7b68988
Record what each round-2 fix does and how it was reproduced

MaxGhenis
and
claude
committed
272283e
Say which fields a recorded block actually needs

MaxGhenis
and
claude
committed
7f628d1
Say what --record-revision is an opt-in over

MaxGhenis
and
claude
committed
0605c47
Say when the manifest guards actually run

MaxGhenis
and
claude
committed
3abacef
Drop a blank line ruff format rejects after the rebase onto #228
MaxGhenis
committed
f6bce08
Gate round: manifest-name refusals reach the CLI, files blocks are validated before I/O, renames are refused by name, preserved-bucket objects are skipped not red, stray default manifests are refused
MaxGhenis
committed
73a1826
Record into a fresh mapping when a manifest's files block is an explicit null
MaxGhenis
committed
d911e1f
Start Sol gate round progress log
MaxGhenis
committed
2e8aae0
Refuse unsafe fetch manifest rewrites
MaxGhenis
committed
7c06b1a
Sweep every package manifest safely
MaxGhenis
committed
19f0cf2
Validate R2 routes before cutover skips
MaxGhenis
committed
4042819
Restore Supabase schema compatibility aliases
MaxGhenis
committed
c218dcc
Make the Supabase cutover instructions truthful
MaxGhenis
committed
701712c
Complete strict artifact preflight coverage
MaxGhenis
committed
2881a8c
Record Sol gate final verification
MaxGhenis
committed
0c04260
Start eight-finding Sol gate progress log
MaxGhenis
committed
8688cbd
Reproduce duplicate manifest key loss
MaxGhenis
committed
7cabf11
Read artifact manifests with strict YAML loader
MaxGhenis
committed
a430d2d
Record strict manifest loader progress
MaxGhenis
committed
a49e1f4
Reproduce artifact and manifest path escapes
MaxGhenis
committed
82d05b4
Harden artifact and manifest path boundaries
MaxGhenis
committed
f2432cd
Record path-boundary fixes
MaxGhenis
committed
403e500
Reproduce stale shared-file revision owners
MaxGhenis
committed
b0d29b7
Update every owner of a revised shared artifact
MaxGhenis
committed
215cc4f
Record shared revision ownership fix
MaxGhenis
committed
20b4028
Reproduce tracked registry cutover failures
MaxGhenis
committed
a644be8
Preserve compatible historical R2 routes
MaxGhenis
committed
eb4d43a
Record cutover compatibility fix
MaxGhenis
committed
ec902b0
Reproduce malformed revision history loss
MaxGhenis
committed
5f55184
Refuse malformed revision history before I/O
MaxGhenis
committed
9e26ca5
Record revision history validation
MaxGhenis
committed
f5efc50
Reproduce frozen Supabase schema aliases
MaxGhenis
committed
27909da
Honor schema env in compatibility exports
MaxGhenis
committed
cdc7968
Record schema compatibility fix
MaxGhenis
committed
9060f18
Reproduce residual artifact boundary escapes
MaxGhenis
committed
1096ace
Close residual artifact path boundaries
MaxGhenis
committed
f2fc086
Record residual path boundary hardening
MaxGhenis
committed
26d22e4
Preflight complete packages before raw publish
MaxGhenis
committed
619d5cd
Reproduce source-package artifact path escapes
MaxGhenis
committed
3db6c85
Reproduce normalized source artifact alias
MaxGhenis
committed
531de1c
Reproduce manifest-named source artifact read
MaxGhenis
committed
70b2d69
Reproduce source-package manifest path escapes
MaxGhenis
committed
bd49f52
Harden source-package artifact paths
MaxGhenis
committed
f431ae7
Reproduce residual artifact side effects
MaxGhenis
committed
446bd17
Preflight artifact operations before side effects
MaxGhenis
committed
6f74c4f
Record artifact preflight verification
MaxGhenis
committed
c4f59fe
Record final eight-finding verification
MaxGhenis
committed
7e62a1e
Reproduce Sol round-3 findings: identity segments, alias enumeration, resource-directory containment, non-regular manifests
MaxGhenis
committed
29336c2
Close Sol round 3: canonical identity segments, alias enumeration, resource-directory containment, non-regular manifests refused
MaxGhenis
committed
768bed8
docs: start peer round 4 fix journal
MaxGhenis
committed
0981354
test: reproduce publication preflight and identity findings
MaxGhenis
committed
317f051
fix: validate immutable R2 provenance in source artifact loading
MaxGhenis
committed
c88b8c7
fix: require exact canonical manifest identity declarations
MaxGhenis
committed
1727737
fix: validate logical vintages in every manifest consumer
MaxGhenis
committed
12ef53d
fix: refuse facts citing configured derived storage routes
MaxGhenis
committed
ce083e7
fix: refuse nonregular source package resources before opening
MaxGhenis
committed
8bb8219
fix: report nonregular manifest siblings through shared errors
MaxGhenis
committed
2c683a4
test: exercise sibling refusal through the top-level CLI
MaxGhenis
committed
2f7cb31
test: cover locator validation and remaining publication routes
MaxGhenis
committed
4cecc72
fix: preflight the complete derived tree before publication
MaxGhenis
committed
1c3a223
fix: refuse normalized artifact aliases in publication and inventory
MaxGhenis
committed
b223066
fix: validate new publication identities before artifact reads
MaxGhenis
committed
1570fec
fix: validate recorded R2 identity before counting inventory links
MaxGhenis
committed
b7c88a1
fix: bind custom derived publication to recognized provenance routes
MaxGhenis
committed
9a6345f
fix: recognize derived R2 provenance regardless of URI scheme case
MaxGhenis
committed
62cc351
test: cover noncanonical report identities and namespace escapes
MaxGhenis
committed
b3511ed
fix: serialize raw identity refusals without weakening validation
MaxGhenis
committed
b87231f
fix: keep publication vintage and build segments inside their routes
MaxGhenis
committed
20663fb
docs: record final focused checks and full-suite restart
MaxGhenis
committed
d6d9fad
docs: record completed peer round 4 verification
MaxGhenis
committed
a00e274
Pin the cutover sweep test by its invariants, not today's registry counts
MaxGhenis
committed
ba8147a
Add licence/access fields and hash-only artifact registration

MaxGhenis
and
claude
committed
c69487d
Register FRS 2023-24 and SPI 2022-23 hash-only, add the emit/plan script

MaxGhenis
and
claude
committed
59e368a
Test the registration refusal surface end to end

MaxGhenis
and
claude
committed
ebddd12
Document hash-only registrations and the BE-SILC blocker

MaxGhenis
and
claude
committed
033723e
Refuse a multi-file vintage in the source-package artifact path

MaxGhenis
and
claude
committed
b9d98d5
Close six escapes found auditing the registration boundary

MaxGhenis
and
claude
committed
8d18199
Document --kind for public microdata releases

MaxGhenis
and
claude
committed
893d13f
Match house doc style in the new sections

MaxGhenis
and
claude
committed
d1eb9c5
Make classification, redistribution evidence and attestation explicit

MaxGhenis
and
claude
committed
95d81d3
Validate the manifest and the filename before a fetch touches anything

MaxGhenis
and
claude
committed
39c8b03
Refuse hash-only entries at the byte reader, before any store is touched

MaxGhenis
and
claude
committed
f061e03
Register consumer pins with their commit and plan the reviewed identity

MaxGhenis
and
claude
committed
63f2bd8
Pin every refusal with hermetic tests and a synthetic consumer checkout

MaxGhenis
and
claude
committed
f85a76d
Document the explicit kind, the evidence rule, attestation and staging

MaxGhenis
and
claude
committed
5ac60ce
Reconcile the rebase onto PR #226's gate round

MaxGhenis
and
claude
committed
203c0c7
Hold the byte boundary across every manifest a package directory keeps

MaxGhenis
and
claude
committed
c4e7c6d
Read manifests strictly and validate every entry field the byte boundary relies on

MaxGhenis
and
claude
committed
5dd2399
Reproduce manifest boundary findings 1 through 4
MaxGhenis
committed
f1c863a
Enforce complete manifest boundary validation
MaxGhenis
committed
b632836
Reproduce registration persistence findings
MaxGhenis
committed
359b0b8
Make hash-only registration atomic and alias-safe
MaxGhenis
committed
8062dbb
Reproduce inventory and sweep findings
MaxGhenis
committed
36d29c8
Validate inventory locators and discover all manifests
MaxGhenis
committed
58508cd
Reproduce consumer pin provenance findings
MaxGhenis
committed
d89cbc5
Bind consumer pins to loaded Git blobs
MaxGhenis
committed
296e754
Reproduce adversarial registration boundary gaps
MaxGhenis
committed
9c0aea1
Extend adversarial boundary reproductions
MaxGhenis
committed
c018235
Refuse symlinked registration output paths
MaxGhenis
committed
8cdd56d
Honor normalized byte identity at every boundary
MaxGhenis
committed
a548f22
Bind recorded R2 objects to complete release identity
MaxGhenis
committed
a70e6b7
Scope release identity checks to microdata
MaxGhenis
committed
32b4081
Reproduce traversal and non-commit pin gaps
MaxGhenis
committed
9c4fb74
Extend final adversarial reproductions
MaxGhenis
committed
7a5be3e
Reproduce publish preflight ordering gap
MaxGhenis
committed
be962e8
Check symlinks before resolving parent traversal
MaxGhenis
committed
84ce20f
Require commit objects and compare FRS access drift
MaxGhenis
committed
85515ee
Preflight complete packages before publishing
MaxGhenis
committed
3ec3f39
Reproduce publish preflight byte-read gap
MaxGhenis
committed
f54f576
Refuse invalid packages before reading artifacts
MaxGhenis
committed
def87bd
Reproduce unhashed public alias escape
MaxGhenis
committed
2868620
Block computed digest aliases of gated bytes
MaxGhenis
committed
953a6f8
Reproduce inventory read after invalid entry
MaxGhenis
committed
2faf50a
Stop invalid inventory before byte inspection
MaxGhenis
committed
8c916be
Reproduce unvalidated source R2 locators
MaxGhenis
committed
6fc7d19
Validate source R2 provenance before content access
MaxGhenis
committed
e6f22fe
Reproduce cross-bucket route shortcut
MaxGhenis
committed
988e48c
Validate recorded routes before bucket preservation
MaxGhenis
committed
8f4407e
Reproduce nested consumer repository provenance
MaxGhenis
committed
e137bd6
Bind consumer pins to repository root
MaxGhenis
committed
c71022a
Reproduce unlocked fetch and publish races
MaxGhenis
committed
bee04e0
Serialize all raw artifact manifest writers
MaxGhenis
committed
db6c846
Reproduce case-variant manifest locks
MaxGhenis
committed
92a20b5
Canonicalize package lock identities
MaxGhenis
committed
03c1b77
Test strict registration text fields
MaxGhenis
committed
12fc502
Require real strings in registration fields
MaxGhenis
committed
a982bdc
Test stray default manifest spellings
MaxGhenis
committed
8646db9
Guard all manifest spellings before fetch
MaxGhenis
committed
770d2ca
Test source reader package collisions
MaxGhenis
committed
ee61630
Validate source reader package collisions
MaxGhenis
committed
60fb56f
Test cross-stage byte identity relabelling
MaxGhenis
committed
ffb3c1e
Compare cross-stage stable byte identities
MaxGhenis
committed
ffeae0b
Test unpinned source cache escape
MaxGhenis
committed
aad5f8a
Refuse unpinned reads beside gated artifacts
MaxGhenis
committed
71cec2f
Test inventory locator refusal ordering
MaxGhenis
committed
753cd02
Stop inventory after locator errors
MaxGhenis
committed
799121f
Test tracked historical publish routes
MaxGhenis
committed
fed9a38
Test malformed public digest fetch escape
MaxGhenis
committed
8455fbd
Validate optional public artifact digests
MaxGhenis
committed
c4f6046
Preserve evidenced historical R2 routes
MaxGhenis
committed
12b5318
test: refuse unwitnessed legacy release routes
MaxGhenis
committed
04e648e
fix: require peer evidence for legacy label routes
MaxGhenis
committed
965af80
Reproduce Astra round-1 findings: legacy -derived routes accepted; YAML-aliased owners skipped on revision
MaxGhenis
committed
49a3ad7
Keep the legacy -derived route rule beside configured routes; identify revision owners by manifest and vintage
MaxGhenis
committed
e72f194
fix: reconcile PR 227 with rebased operational contracts
MaxGhenis
committed
426651e
docs: record rebase audits and baseline gate in progress
MaxGhenis
committed
076d155
Judge duplicate manifest keys before YAML merges expand
MaxGhenis
committed
ff99d83
docs: record passing full post-rebase baseline
MaxGhenis
committed
a793e32
test: reproduce malformed source entry after rebase
MaxGhenis
committed
f3da2c0
test: reproduce cross-vintage fetch overwrite
MaxGhenis
committed
f9d8568
test: reproduce unrelated consumer repository provenance
MaxGhenis
committed
4ab9292
test: reproduce gated aliases of archived revisions
MaxGhenis
committed
3f630e6
fix: preserve malformed source entry refusal after rebase
MaxGhenis
committed
295f5a9

Commits on Sep 5, 2026