Publication-Candidate Packet

This is Lee's product-side publication-readiness report for the strongest sealed candidate. The selection record identifies repair-8ab0ca9952d8 as the newest sealed candidate with two-page coverage, passed product validation, passed reader evidence with no findings, and a prior independent review with no findings. It is evidence for a human decision, not approval, promotion, publication, serving, rollback, or a live-directory action. The report keeps the candidate-only metadata and boundary intact.

The current sealed source boundary is sources/authority.json, revision 2026-08-08, SHA-256 973d42700fcf5046c8c1b8b408337987537e04d8eec4c742574fb30f7a10c3b6, with exactly source.naming-decision, source.documentation-boundary, and source.platform-delivery-contract; employee_may_modify is false. The three source records are registered public-safe. Private governance material is not copied into this packet.

Verified Projection

The strongest sealed release is repair-8ab0ca9952d8, selected by releases/publication-readiness-candidate.json and described by releases/publication-readiness-report.md. Its immutable release manifest is releases/repair-8ab0ca9952d8/release.json; it records status: candidate, publication_status: candidate-only, promotion_ready: true, previous_release: null, rollback_target: null, and rollback_available: false. promotion_ready is a product-side candidate fact and is not approval or permission to serve.

The exact immutable product serving artifact available in the sealed release evidence is releases/repair-8ab0ca9952d8/projection/index.json, SHA-256 26785c2bd526d50389afed09571debdb1235a64354370613c845c0837166977e. It is an immutable projection index, not proof that a complete externally managed webroot bundle or nginx configuration is available. Its identity is content revision 881f1b6771dc612d0f3472306cb6d3797fb230846a5f69b08718048b511a80af, release authority digest 5e8f4793ce2e526a73f0065e0c045849ff8610e934d83e3307a0c1af52d9a549, renderer renderer-v0, and theme theme-v0. It names claim claim.governed-documentation-product, models models/engine-overview.json and models/no-additional-work-reader-journeys.json, and exactly these public pages:

• page.governed-execution-engine-overview at content/public/engine-overview.md, with body SHA-256 51ef85f994378f69fdcf7ab44b69e779ed6b3491ef5eaa5d94fbb09adab1850b.
• page.no-additional-work-cycle at content/no-additional-work-cycle.md, with body SHA-256 8cf20809d7868d059ed8b8f9629b9caa140ce4572c0dd432ab25db20dc42e8b3.

The immutable validation.json records passed: true for seven product checks: schema and references, model and craft schemas, internal links, protected and generated paths, reader journeys, public safety, and reproducible projection. The selected release's reader record marks journey.owner-overview passed, with command python3 tools/validate_content.py --journey journey.owner-overview, exit code 0, and no findings. Its “Ready for controlled pilot” recommendation is product-side evidence only. The attached review record is a prior sealed pass with no findings; it is not a fresh independent review for this report.

The selected release snapshot carries authority revision 2026-08-04 and the older digest above, while the current sealed authority is revision 2026-08-08 with the current SHA-256 above. The workspace build/index.json also has a different newer content revision, b82ec59383bbffd712dbdda59f75468594044d84e9e7a43d1e3d82d5bf01261e. Neither current state is substituted for the named immutable artifact.

The preserved validator evidence for this handoff was not rerun. The exact preserved command was:

PYTHONDONTWRITEBYTECODE=1 python3 -c "import hashlib; from pathlib import Path; assert hashlib.sha256(Path('sources/authority.json').read_bytes()).hexdigest() == '973d42700fcf5046c8c1b8b408337987537e04d8eec4c742574fb30f7a10c3b6'"

It exited 0, was marked passed, took 0.083659 seconds, and has evidence hash b451aeac25a532f1f5ee712593e1ed66861e5504f6e33581b6c3a6ed92b200e6. The preserved record reports empty stdout and stderr; no result counts are claimed.

Embarrassment-Risk Gaps

These are all remaining risks visible in the supplied evidence; none is resolved by readiness wording or by the presence of an immutable candidate:

1. Lee's human readiness decision is open. The product report can recommend review, but it cannot supply human approval. Controlled-pilot authorization is a later and separate decision.
2. No authority for the externally managed serving boundary is present. The workspace contains no authorized webroot path, nginx configuration or site identifier, serving owner, permitted staging/switch mechanism, health check, or rollback runbook. No such path, configuration, or command may be inferred.
3. The only exact immutable product serving artifact named by the sealed release evidence is the projection index above. The evidence does not prove that it is a complete renderable webroot bundle, so a human must decide its sufficiency or provide a separately authorized immutable bundle manifest.
4. The selected release's authority snapshot is older than the current sealed authority. The preserved authority hash check establishes the current file's digest; it does not re-verify the selected release against current authority.
5. The selected reader evidence covers only journey.owner-overview. The three journeys in the dedicated report manifest are reader-contract requirements, not executions performed by this authoring step.
6. The separate platform-owned journey journey.resolve-reader-journey-harness-decision has one recorded attempt: python3 tests/check_documentation_smoke.py exited 1 with observed output Operation not permitted because the evaluator environment denied localhost socket access. This establishes an environment-specific evaluation blocker, not a recurring product harness defect, retry count, affected claim, or repair target. A permitted follow-up must preserve the journey ID, exact command, exit status, output, recurrence or retry evidence, source references, and affected work item before a defect is named.
7. Platform-owned route, validator-authority, repository-identity, execution, evidence-chain, terminal, approval, and serving attestations are not established by this product packet.
8. The selected candidate records no approved previous release and no rollback target. Older candidates are comparison evidence, not approved prior versions. A reversible serving action cannot honestly name a rollback target until a human-authorized operator records one.
9. publication/current-release.json is absent, and the selected immutable snapshot differs from the current workspace projection. The candidate must not be represented as the current release, and the current projection must not overwrite or silently replace the sealed snapshot.
10. The selected release's promotion_ready: true, reader recommendation, and prior review pass are candidate-evidence facts. They do not establish publication approval, a serving action, a live-directory write, or a fresh independent review for this report.

Publication Boundary

This report and repair-8ab0ca9952d8 remain candidate-only product material. The local conceptual boundary is publication/current-release.json, which is absent and was not created or changed. No approval, promotion, publication, scheduling, activation, rollback, pointer mutation, or live-directory write was performed or is claimed. In particular, the exact immutable projection index is identified for Lee's review; it has not been copied to, mounted at, or served from any external webroot. The report cannot establish that serving would be safe until the missing external boundary authority and artifact sufficiency decision are supplied.

The human decision needed is bounded: Lee must decide whether to authorize the reversible serving plan after an authorized operator supplies the exact externally managed webroot path, nginx site/config identity, permitted change mechanism, health-check evidence, and rollback target. Lee must also decide whether the named immutable projection index is sufficient or whether a separately sealed complete serving bundle is required. Nothing in this packet grants that authority or treats the product recommendation as publication.

Reversible Serving Plan

The following is a conditional plan for the existing externally managed boundary, not an execution record. First, the authorized operator supplies the missing webroot and nginx boundary authority, identifies the current serving target and a recoverable rollback target, and records the permitted staging and switch procedure. No path or nginx command is invented here. Second, Lee reviews the exact artifact releases/repair-8ab0ca9952d8/projection/index.json and its SHA-256, and decides whether that projection index is the approved serving artifact or whether a separate immutable bundle must be supplied.

Only after those decisions should the authorized operator stage the approved immutable artifact without modifying its release directory, capture the before-state and staged hash, and use the existing approved boundary procedure to make a reversible switch. The operator then performs the human-approved health check and records the after-state. If the hash, artifact completeness, health check, or boundary authorization does not match, the operator stops and leaves the candidate parked. If service is unhealthy, the operator restores the previously recorded approved target; because this candidate records no prior approved release, no rollback target may be invented. Lee's reversible default until all of this authority is present is no serving action, no pointer change, and the candidate remaining parked for review.