Prepare offline peer acceptance fixture and operator evidence worksheet

[Exohayvan]

Prepare a reproducible offline acceptance kit while real two-computer setup remains pending operator selection and approval. The new generator writes a public 8-MiB fixture with 256 distinct chunks, its canonical SDK transfer manifest, and a JSON worksheet initialized entirely to not_run. It creates no identities, makes no connections, starts no listeners and grants no trust or acceptance.

The operator checklist is linked from the existing runbook. It separates required approvals/identities/endpoints, proposed budgets and measured observations; explains the clean three-checkpoint/253-missing-chunk case versus the existing crash-recovery/252-missing-chunk test; and preserves the separation between header claims, pack validation and publisher authority.

Output goes only to a new physical directory in a trusted stable parent, with directory mode 0700 and files mode 0600. Existing directories are never reused. Partial I/O failure leaves partial output and reports failure without claiming rollback or exposing underlying diagnostics. Generated binaries and machine-specific evidence remain outside Git and active app checkouts.

Validation:

• Repository-native fast gate passed: 1,457 tests, 2,811 subtests, 100% branch coverage; lint/format, strict types, integrity, dependency/workflow and size checks passed.
• Four dedicated offline tests passed on Python 3.11 and 3.14, including deterministic content/chunk/manifest integrity, private modes, refusal to overwrite, invalid inputs, partial failure and seven runbook CLI parsing cases. Socket creation is blocked in offline fixture/parsing tests.
• Generated the kit locally and verified all observation/input fields remain blank/not_run. No real-machine setup was performed.
• Source clone/unused-code/complexity checks passed.
• Head: 8ff4c23746d993c2f1ec34aa1382b88e4bcc987e; tree: df9297006749cae048f7c9d1c96f25bc8c873572.

The established validation suite uses disposable test-only credentials and loopback listeners; this is separate from the generator and grants no persistent access. Actual second-machine installation, operator-managed identities, trusted pins, routing and foreground-listener permission remain pending. Keep this draft unmerged for independent exact-head review and final hosted checks.