fetch now surfaces the artifact's build-origin class in its report
("provenance: class=<c>" after sidecar retrieval, table-aware read,
both payloads, re-wrapped, pinned in runtimecmd_provenance.test) -
the acceptance's consent-surface clause.
END-TO-END DEMONSTRATION (live, fully reverted): fixture punkbin
served via httpfixture with a suffixless testplat-x86_64 runtime; the
committed bin/punk-runtime.cmd fetched fakert-suite-r1 (-platform +
-trust-server; sha1 ok, sidecar + provenance line) and 'use -platform'
materialized the working copy; a temporary mapvfs entry wired it to a
bakelist row: runtime file bin/runtime/testplat-x86_64/fakert-suite
(present), target=testplat-x86_64 - with the .exe-named negative half
(runtime=missing) captured first. Config reverted, tier removed, tree
verified clean. Live canonical evidence also captured: unattended
fetch of tclsh9.0.5-punk-r2.exe from the real origin ran gate-free
(published r2 hash matched).
Full battery: provenance 5/5, freshness + checkfile 12/12,
runtimebash_wsl PASS, dtplite 8/8 (after its separate 0.35.1
pre-existing-fallout fix), roundtrip byte-identical under the punk
baseline runner. Acceptance walk recorded item-by-item in the goal
Progress - every item evidence-satisfied; user-gated follow-throughs
(punkbin push + classification review; index Scope ps1-path
correction) recorded as outside acceptance.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Julian Noble
670ab78dd8