User-approved draft from the publication-session design exchanges:
embed a copy of the artifact record in the attached image (embed-then-
hash ordering; sidecar + sha1sums stay the integrity authority) with a
punk-runtime 'info' action for stray/renamed binaries (zip-central-
directory read preferred over executing the target), AND harden the
record as schema v1: schema, build_id (embedded+sidecar correlation
uuid), origin (canonical repo built FOR - the timing-safe reframe of
first-published-on; mirrors preserve it), packager (declarative;
minisign noted as the verification complement), project/project_url,
license summary, build_host_platform. Emitted records gain brief toml
'#' comments for non-obvious fields (line-based consumers ignore them
by construction). Lifecycle fields deliberately rejected as repo-level
curation. Next emission after landing = r2; published r1 immutable.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble