Index entry + detail file with the two user-directed amendments over the
presented draft: consent keyed to SERVER TRUST (trusted set defaults to the
canonical punkbin origin - no new prompts in existing flows incl. the
unattended tclsfe-x64 constraint fetch; untrusted/alternative servers gate
with a G-006-pattern acknowledgement surfacing the provenance class), and
retroactive schema-v2 provenance sidecars for the existing punkbin
third-party artifacts (additive only - bytes, bare pre-family names,
sha1sums.txt authority unchanged). Signing deliberately deferred per user
("down the track") with the minisign anticipation noted. Depends on G-122;
Related G-006/G-067/G-105/G-101; extends archived G-103/G-119 machinery under
a G-117 schema-v1 -> v2 bump. G-122's follow-on note now cites G-123 by id.
Claude-Session: https://claude.ai/code/session_01Jz7wkUsknJzyuJ3tgMaL2t
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble