Enforce source and native package provenance for WP00.03

[deku2026]

The current source tree and native NuGet producers could accept reused material without a complete, immutable provenance record. WP00.03 now checks every source file and records the actual native artifact closure: 36 upstream components, full applicable notices and corresponding sources, 174 port recipes, four toolchain definitions, and the separately reviewed Microsoft runtime binaries. Candidate inspection rejects changed or unrecorded members, including files disguised as NuGet metadata.

The producer verifies actual CMake caches, installed vcpkg ABI records, compiler paths and runtime signatures. Minimal overlays of the existing standard triplets pin MSVC 14.51.36231; dependency builds use CMake 4.4.0 and owned wrappers retain CMake 4.3.3/Ninja 1.13.1. This follows merged Design PRs #23 and #24 (authority 5322d698a1b650a52a5a139d986dd85b00b48581). Existing records remain immutable through superseding revisions. The exact Meson helper recipe has two verified SPDX forms: an empty resource list when the patched tool already exists, or the single reviewed Meson source archive on a cold build. Profile revision 3 admits only those forms and preserves strict URL/hash and runtime-resource validation. The Apache provenance checker and original tests retain their exact Contracts source record and licence.

• Validation: 41 provenance tests, 26 existing Design/licence tests, current naming and full Design corpus checks; locked .NET 10.0.400 build and format, four architecture tests, all 35 managed/IDE licence scopes; win.slnx Release|x64 with zero warnings/errors; both actual CMake profiles, four CTest cases and managed P/Invoke; actionlint and gitleaks.
• Candidate 1.0.0-wp00.3.b0a09a7, source b0a09a7990860a54e3b1dcbeddcd18cc24265daa: ten NuGet archives passed twelve package guard tests, isolated Build.Policy smoke, five JIT and five Native AOT cases, and one independent C17 executable covering all four native ABIs. Wrong RID, missing owned/transitive DLLs and changed DLLs are rejected. The full evidence and candidate archives remain in the retained worktree.
• Compatibility: existing package identities, dependency versions, C ABI and probe behavior are unchanged. The reviewed native legal/source additions and producer checks do not introduce browser UI into desktop or Android applications. Existing visualCppRuntime.version semantics are retained alongside explicit directory and actual file versions.
• Pending: final PR CI, merge, main-branch candidate tests/publication and exact public NuGet verification. This PR completes the DesktopPlatform portion of WP00.03; other owners and later product/commercial gates remain separate.

[deku2026]

Full self-review of 3bc1917d5cb2d76261c0e27ceba774b9067da8c6..0c31fd7c78f75f1333786883560a20ba5a8c5d0a completed against WP00.03 and Design 5322d698a1b650a52a5a139d986dd85b00b48581.

Reviewed all source and workflow changes, source inventories, legal bytes, generated declarations, all native records/profiles and their immutable predecessors, toolchain overlays, packaging/inspection paths, negative tests and documentation. The 36 upstream component identities, package catalogue and owned C ABI remain unchanged. All 42 initial records are retained byte-for-byte; revised records explicitly supersede them.

The review found and fixed two concrete issues: the existing native-artifact rejection diagnostic was lost, and a metadata-prefix exemption admitted unrecorded NuGet resources. The final metadata allowlist names exact producer files; tests reject both an extra script in metadata and an extra nested nuspec. Another collection finding was that development builds used different local generators/compiler selection; those artifacts were not used for acceptance. The entire dependency closure and owned CMake outputs were rebuilt with the reviewed pins after the narrow Design repair was merged.

Final source audit: 316 files, ten reused source files, 79 immutable records, 42 active records, clean source 0c31fd7c78f75f1333786883560a20ba5a8c5d0a. All 38 provenance tests pass, including source/history mutation, legal/resource/recipe/feature drift and candidate closure failures. Four final commits pass gitleaks. Local managed, native, package and isolated JIT/AOT/C17 checks listed in the PR description pass on the final candidate. Actual managed consumer evidence is retained at artifacts/native-consumer-evidence/evidence.json and source evidence at artifacts/evidence/provenance-final-source.json in the worktree.

No remaining actionable findings in this scope. PR CI and post-merge publication are still required; this review does not replace them or claim product readiness.

[deku2026]

Reviewed the complete added change through b0a09a7990860a54e3b1dcbeddcd18cc24265daa, including all 36 superseding records and the full profile. The prior 79 records are byte-unchanged. The new profile differs only in revision bindings and the exact two independently reproduced SPDX forms of the already reviewed Meson helper. No dependency, runtime material, licence, compiler, ABI or package identity changed.

CI failure 35424021503 occurred after native compilation/CTest/PInvoke, when cold tool acquisition added the Meson resource to SPDX. A separate retained cold build reproduces that resource and digest; the existing installed helper has an empty resource list because the exact patched tool was already available. The pinned recipe explains both paths. Revision 3 permits only that build-only omission; altered URL/hash, duplicate/additional resources and absent runtime sources still fail. Full legal texts and recipes remain mandatory in both cases. Diagnostics now expose the actual public source identities when this comparison fails.

All 41 provenance tests pass. The final clean source inventory has 353 files, 10 reused targets, 115 historical records and 42 active records. Both actual Meson receipts pass. Existing immutable source/legal evidence, source history, actionlint and gitleaks pass. Candidate 1.0.0-wp00.3.b0a09a7 was staged from the previously tested unchanged native binaries; all ten NuGet archives pass independent closure, 12 package guards, isolated Build.Policy smoke, five JIT/five Native AOT cases and the independent C17 caller covering all four ABIs. Retained consumer tree: arcforges-native-consumer-tvxbdeoh.

No actionable finding remains in the complete local change. All applicable hosted CI must pass on this new head before merge; main publication and exact public package verification remain pending.

GitHub refused its combined diff endpoint at the 20,000-line limit. The complete paginated PR file list and every remote file blob SHA were therefore independently matched to the reviewed base/head Git objects; all 147 files match. No file was omitted from review.

[deku2026]

Post-merge verification complete for 5cb1121dc2312a10fba4424005ec29b4ad5d0113, version 1.0.0-ci.13.1.

• Main publication run completed successfully.
• Downloaded all 10 packages directly from public NuGet. All 599 original candidate members are byte-identical; the only added member is NuGet's registry signature. Revalidated the public packages against the source and native legal profile.
• Independent consumers restored the public packages in isolated directories: policy consumer and AFP002/003/004/005 rejection fixtures passed; all five native consumers passed both JIT and Native AOT; an independent C17 caller executed all four ABIs. Wrong RID, missing owned/transitive DLLs and modified DLLs were rejected.
• The primary checkout is clean and fast-forwarded to the merge commit. Branches, worktrees, downloaded artifacts and consumer directories are retained.

Detailed local evidence: artifacts/post-merge-ci13/post-merge-closure.json, public byte/member hashes, consumer logs and native consumer evidence. These results close DesktopPlatform's WP00.03 publication and consumer gates; later product functionality is outside this change.