feat: verify immutable Design policy exports for WP00.01

[deku2026]

WP00.01 makes the reviewed glossary and invariant mappings reproducible, and detects documentation/citation/graph drift before package creation. Export 135 term rows (148 names), 16 contextual forbidden-alias rows and all 429 invariants from exact Design commit 1607374e81955f0a47f319cd6cc8ba1c6e254157; preserve planned verification and the three retired absence-test rows.

The required Windows/Linux gate fetches that immutable public documentation snapshot, checks all 172 current documents, 11,411 local links, 7,601 scoped rule homes, 9,436 rule citations, 171 exact classified occurrences and the 51-node/158-edge dependency graph, then compares regenerated export bytes. No Design examples execute and no sibling product sources enter a build.

Validation: full self-review with the sentence-boundary/compound-citation findings fixed at Design PRs 15–17; 15 independent corruption-test groups; real isolated-fetch CLI; locked .NET 10.0.400 restore/build (0 warnings/errors), 4 architecture tests and format check; actual nine-root naming scan with the derived declaration consumed. Twelve unchanged packaging guards also pass against the existing authentic main candidate 1.0.0-ci.7.1 (97fe0af); they are not evidence for this new candidate.

Dependency: merge Contracts PR15 before this export. Latest-head native/package/consumer CI and post-merge NuGet publication remain pending. No runtime invariant or product-readiness gate is claimed.

[deku2026]

Full final-diff self-review: reviewed all authored tooling, tests, gate dependencies and documentation; generated JSON is byte-for-byte reproducible from the reviewed immutable Design input, with every catalogue/coverage row location independently checked. Negative fixtures exposed and fixed compound citation, sentence-boundary and registration drift issues; corresponding authority repairs are merged. Reviewed AGPL ownership and the narrow independent Apache registration boundary. No outstanding code findings. Local checks and exact scopes are in the PR body; latest-head CI and publication remain mandatory and pending. Merge after the companion Contracts registration and all applicable checks.

[deku2026]

Final merge review for 5fc1ca9: all 10 applicable jobs in CI 35388369124 succeeded, including native compilation, candidate integrity and independent Windows/Linux package consumers. Both new policy-job artifacts were downloaded and have identical immutable export hashes. Full diff review has no outstanding findings. Contracts PR15 is merged and its pulled main scanner accepts this actual export and declaration. Proceeding with normal merge; main artifact publication and final integration remain mandatory before WP00.01 completes.

[deku2026]

Post-merge verification for this WP00.01 candidate is complete.

Merged source 05d2bc96059ba6e8515c89b0c20600e602066aa2 produced release 1.0.0-ci.8.1. Main CI passed all 12 jobs. The downloaded candidate verifies all 10 package hashes and the native artifact identity. All 10 public NuGet packages now match candidate contents (excluding only NuGet's added signature).

Windows and Linux policy receipts are identical apart from their verification timestamp and match Design 1607374e81955f0a47f319cd6cc8ba1c6e254157: 135 term rows, 148 names, 429 invariants, 16 alias rows, 172 documents, 9,436 scoped citations, 11,411 links, 51 active packages and 158 edges. The exact Windows candidate passes five JIT and Native AOT native consumer cases, a real C17 consumer and four DLL/RID rejection cases. Linux's independent managed package consumer also passed.

Post-merge negative-input review identified two bounded enforcement gaps: an unqualified product term at glossary section 5 itself and an inactive package's Downstream-only header. Both were fixed, regression-tested, fully reviewed and merged in #46. That repair leaves all exported policy bytes unchanged and has its own exact-candidate post-merge evidence. The current primary checkout has been pulled to its merged commit d5aacf154771f4b2aff33ca5268df9a6942ff2fb.

Receipts remain under artifacts/evidence/main-* in the retained codex/wp00-01-design-policy worktree. Policy data records planned verification; these results do not close PG-11 or assert product/provider/device/commercial readiness. Follow #46 for final WP00.01 closure.