Enforce reviewed source and Worker artifact provenance

[deku2026]

The existing AI candidate gate checked an outer manifest, but did not independently classify bundled/generated resources or enforce immutable source reuse records. This adds reviewed source inventory and append-only records, verifies the actual Worker/input/source-map/resource closure and complete legal texts, and carries source-bound provenance into the candidate and deployment gate.

The artifact profile covers both installed protobuf runtime versions, their complete Apache/BSD notices, the esbuild helper and Wrangler generated README. Source checks are an explicitly reviewed AGPL port from merged Cloud commit 3165c97cccd3ea1e0b230d66e22ab9c775ca19d8; AI owns the port without sibling source imports. Application TypeScript remains 7.0.2; audit-only TypeScript 6.0.3 reproduces upstream dependencies and is not added to the project. No runtime/model, Contracts version, lockfile or private routing changes are made.

Validation at e9bca4b3a33b204941901e4d66eb0c149615f831:

• Windows and Linux: full checks, 56 local Workflow/unit scenarios and 81 tooling tests; exact binding regeneration; actual candidate and compiled Worker/Workflow tests. Inference is explicitly mocked locally.
• Independent reproduction of all 97 parsed protobuf modules; 104 total parsed inputs, 45 emitted inputs and 43 source-map bodies matched the reviewed bytes.
• Naming, actionlint, npm audit (zero vulnerabilities), full-history secret scanning and four probes of the narrowly scoped public-hash false-positive exception passed.
• Review findings fixed: full configuration oracle, reproducible relative source-map root with rejection test, stable SBOM package identity and exact public-hash scanner exception. Historical records/profiles are retained.

This is only AI's WP00.03 contribution against Design 5322d698a1b650a52a5a139d986dd85b00b48581. Final PR review and all applicable CI precede merge; main deployment must still prove real guarded model/tool/model inference and public release-byte identity. Later commercial-product features are outside this change.

[deku2026]

Full implementation review completed at e9bca4b3a33b204941901e4d66eb0c149615f831 (39 changed files). Every remote PR file blob matches the locally reviewed Git tree.

Reviewed the source/record policy and immutable history, source-port provenance, actual bundler inputs and source-map paths/bodies, both runtime versions and SBOM edges, full legal texts, candidate resource closure and configuration transformation, Git hook/environment isolation, negative tests, private Workflow boundaries, and main-only promotion flow. Review findings were fixed before opening: full configuration binding, relative source-map root with regression test, stable root SBOM identity, and a narrowly verified public-hash scanner exception. No unresolved finding remains.

Windows and Linux passed the complete checks, 56 explicitly mocked local Workflow/unit scenarios, 81 tooling tests, exact binding regeneration and actual compiled Worker/Workflow execution. Source port hashes, all 97 independently reproduced protobuf modules, npm audit, naming, workflow syntax, full-history secret scanning and the scanner-exception probes passed. No real inference is inferred from local fixtures.

Merge remains conditional on all applicable checks succeeding on this exact head. Main deployment, guarded real inference and public release-byte verification follow the merge. Prior record/profile revisions and both worktrees are retained.

[deku2026]

Post-merge verification complete for b26f05c73271693636d89a83a24f8cd66eac26b2, release 0.1.0-ci.24.1.

• Main run passed all applicable checks and actual private Cloudflare deployment.
• Real Workflow evidence records accepted revision/version admission, Worker version 9ab23f7f-325e-4edf-aff4-ed6b7ed5d118, exactly two Workers AI model calls with @cf/openai/gpt-oss-20b, the say_hello tool, and the expected final greeting. This is the real provider gate, separate from local mocks.
• Downloaded all three public release assets, verified their GitHub SHA-256 digests, and matched all 20 candidate members byte-for-byte against the CI candidate. The public live receipt is byte-identical to CI and binds the exact public candidate manifest digest.
• Independently verified the public candidate against the merged source and immutable profile, then ran its actual compiled Worker/Workflow locally with explicit inference mocks. No candidate rebuild or additional model execution was used for that public-file check.
• The primary checkout is clean and fast-forwarded. PR and post-merge branches/worktrees, Linux worktree and all evidence are retained.

Local closure: artifacts/evidence/post-merge-closure.json in codex/wp00-03-postmerge-verify. AI's WP00.03 publication/inference gates are now closed; this does not establish later product features.