Two halves of one file-relative policy decision. G-134 (new, proposed): advisory
post-assembly punk::zip::archive_info probe at the G-133 seam pins make.tcl's own
kit outputs archive-relative - by-construction property becomes a checked contract;
mkzip -offsettype file and modpod stay available for deliberate manual creation.
G-128: the straight file-relative refusal becomes default-refuse with a consent-flag
preserve (central-directory offset fix-up by the shift delta, zip64/multi-disk still
refused), plus Notes recording the rationale, the Authenticode sign-after-stamping
rule, and the convention-conversion parking. goals_lint clean (85 active, 49
archived).
Assisted-by: harness=opencode; primary-model=openrouter/moonshotai/kimi-k3; api-location=openrouter.ai
Julian Noble