Publish verified 12 MP evidence archive

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
   pull_request:
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
@@ -56,12 +57,26 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Fetch public evidence comparison base
+        env:
+          PUBLIC_EVIDENCE_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ -n "$PUBLIC_EVIDENCE_BASE_SHA" ] && [ "$PUBLIC_EVIDENCE_BASE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            git fetch --no-tags --depth=1 origin "$PUBLIC_EVIDENCE_BASE_SHA"
+          fi
+
       - name: Install evidence replay tools
         run: |
           sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends ffmpeg
+          sudo apt-get install --yes --no-install-recommends ffmpeg zip unzip
           ffmpeg -version | head -n 1
 
+      - name: Verify public evidence append-only evolution
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PUBLIC_EVIDENCE_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: pnpm verify:public-economic-resilience-evolution -- --base "${PUBLIC_EVIDENCE_BASE_SHA:-0000000000000000000000000000000000000000}"
+
       - name: Verify package
         run: pnpm verify
 

README.md

@@ -373,8 +373,9 @@ Important limitations:
 
 ## Development verification
 
-The full repository gate requires `ffmpeg` and `ffprobe` so retained and
-newly generated native image evidence can be decoded and visually replayed.
+The full repository gate requires `ffmpeg`, `ffprobe`, `zipinfo`, and `unzip`
+so retained and newly generated native image evidence can be decoded, boundedly
+inspected, and visually replayed.
 The pinned Docker lane includes both tools.
 
 ```bash
@@ -394,6 +395,8 @@ pnpm example:ios:transformer-test
 pnpm docs:check
 pnpm site:check
 pnpm site:build
+pnpm verify:public-economic-resilience-evidence
+pnpm verify:public-economic-resilience-evolution -- --base <base-commit-sha>
 pnpm fixtures:compatibility:check
 git diff --check
 pnpm pack --dry-run
@@ -429,6 +432,21 @@ conversion and allows only a 0.001 SSIM implementation tolerance after both
 measurements independently pass the quality and orientation gates. The bundle
 is an environment-specific observation, not a speed ranking, cost-savings
 claim, or real-device benchmark.
+Exact-master Android and iOS bundles can be retained separately from the
+published-package demo in an append-only, full-SHA-addressed public archive.
+`pnpm import:public-economic-resilience-evidence -- --run-id <id>` queries the
+GitHub run and artifact APIs directly, requires one successful
+`workflow_dispatch` run on `refs/heads/master`, downloads the exact Android and
+iOS artifacts by ID, and retains their digest-bound ZIP bytes. It refuses
+replacement or orphaned index state and binds byte-identical source/fixture
+assets across platforms.
+`pnpm verify:public-economic-resilience-evidence` independently replays the
+portable visual contract and ZIP-to-file equality for every retained bundle.
+The CI evolution gate prevents deletion, reordering, or byte changes to any
+earlier capture. The empty archive state is valid; the
+[economic resilience page](https://ggulbae.github.io/react-native-image-compression-kit/reference/economic-resilience)
+shows a methodology preview while empty and switches to exact archive-derived
+metrics, assets, and workflow provenance after a capture exists.
 Comparison dependencies remain inside the private example application and
 outside the published package. See the
 [benchmark methodology](docs/benchmarks/README.md) for its timing boundary,

docs/verification-architecture.md

@@ -17,6 +17,7 @@ from the npm package.
 | Native demo result metrics, source/output/screenshot/recording bytes, auto-oriented SSIM and vertical-flip control, ordered walkthrough timing, parsed video-track duration, timestamp normalization, digests, platform provenance, and exact source identity | `test/demoEvidence.test.mjs`, `test/demoVisualAgreement.test.mjs`, `test/guidedDemoCore.test.mjs`, `test/demoCaptureScriptContract.test.ts`, `scripts/demo-evidence-core.mjs`, `scripts/demo-visual-agreement-core.mjs`, and `scripts/guided-demo-core.mjs` | Native Demo Evidence workflow and `pnpm verify:demo-evidence` |
 | Native baseline and exact-plan implementation comparison metrics, balanced sample positions, comparator identity, fixture/plan bytes, digests, and platform provenance | `test/benchmark.test.mjs`, `test/benchmarkComparison.test.mjs`, `scripts/benchmark-core.mjs`, and `scripts/benchmark-comparison-core.mjs` | Native Demo Evidence workflow, `pnpm verify:benchmark-evidence`, and `pnpm verify:benchmark-comparison-evidence` |
 | Kit-only 12 MP source/output bytes, exact environment and capabilities, call-only timing, decode/geometry, a `strip` request with no APP1/APP13/JPEG comments, explicit full-to-limited-range SSIM/flip control with a 0.001 replay tolerance, signed byte difference, and zero package-output residuals | `test/economicResilienceBenchmark.test.mjs`, `test/economicResilienceEvidence.test.mjs`, `test/economicResilienceNativeSourceContract.test.mjs`, and `scripts/economic-resilience-evidence-core.mjs` | Native Demo Evidence workflow and `pnpm verify:economic-resilience-evidence` |
+| Append-only exact-master 12 MP archive topology, GitHub-bound run/artifact identity, retained ZIP-to-file equality, cross-platform source identity, economic claim boundary, crash recovery, revision evolution with live reacquisition for new suffixes, and independent portable visual replay | `test/publicEconomicResilienceEvidence.test.mjs`, `test/publicEconomicResilienceEvolution.test.mjs`, `scripts/public-economic-resilience-evidence-core.mjs`, `scripts/public-economic-resilience-github.mjs`, and `scripts/public-economic-resilience-evolution-core.mjs` | `pnpm import:public-economic-resilience-evidence -- --run-id <id>`, `pnpm verify:public-economic-resilience-evidence`, and `pnpm verify:public-economic-resilience-evolution -- --base <sha>` |
 | Packed-consumer compatibility lane definitions | `test/compatibilityMatrix.test.mjs` and `scripts/compatibility-matrix-core.mjs` | `pnpm fixtures:compatibility:check` and the Compatibility workflow |
 | Built public-site performance, accessibility, and SEO | `scripts/verify-site-quality.mjs` | `pnpm site:build && pnpm site:quality` |
 | Repository metadata, security features, Actions policy, rulesets, environments, and Pages | `test/repositorySettings.test.mjs`, `docs/repository-settings.json`, and `scripts/repository-settings-core.mjs` | `pnpm fixtures:repository-settings:check` and `pnpm audit:repository-settings` |
@@ -72,6 +73,8 @@ pnpm docs:check
 pnpm site:check
 pnpm site:build
 pnpm site:quality
+pnpm verify:public-economic-resilience-evidence
+pnpm verify:public-economic-resilience-evolution -- --base <base-commit-sha>
 pnpm fixtures:compatibility:check
 pnpm fixtures:repository-settings:check
 pnpm audit:repository-settings
@@ -101,6 +104,8 @@ smoke test in their supported environments.
   methodology documentation together.
 - Change workflow actions or pins in the workflow supply-chain verifier.
 - Change release evidence rules in the evidence-specific verifier and fixtures.
+- Change public source-tree evidence in the append-only importer, archive
+  verifier, methodology page, and archive mutation tests together.
 
 ## Non-goals
 

package.json

@@ -81,6 +81,9 @@
     "verify:benchmark-comparison-evidence": "node scripts/verify-benchmark-comparison-evidence.mjs",
     "economic-resilience:evidence": "node scripts/create-economic-resilience-evidence.mjs",
     "verify:economic-resilience-evidence": "node scripts/verify-economic-resilience-evidence.mjs",
+    "import:public-economic-resilience-evidence": "node scripts/import-public-economic-resilience-evidence.mjs",
+    "verify:public-economic-resilience-evidence": "node scripts/verify-public-economic-resilience-evidence.mjs",
+    "verify:public-economic-resilience-evolution": "node scripts/verify-public-economic-resilience-evolution.mjs",
     "merge:demo-evidence": "node scripts/merge-demo-evidence.mjs",
     "release:dry-run": "node scripts/release-dry-run.mjs",
     "smoke:consumer": "pnpm build && node scripts/consumer-smoke-test.mjs",
@@ -116,7 +119,7 @@
     "verify:action-pin-attestation": "node scripts/verify-action-pin-attestation.mjs",
     "verify:action-pin-fixture": "pnpm verify:action-pin-provenance -- --artifact-dir test/fixtures/action-pin-review --json",
     "verify:action-pin-attestation-fixture": "pnpm verify:action-pin-attestation -- --artifact-dir test/fixtures/action-pin-review --attestation-bundle test/fixtures/action-pin-attestation/attestation.jsonl --trusted-root test/fixtures/action-pin-attestation/trusted-root.jsonl --json",
-    "verify": "pnpm typecheck && pnpm test:coverage && pnpm build && pnpm docs:check && pnpm site:check && pnpm fixtures:compatibility:check && pnpm fixtures:ios-pass-replay:audit && pnpm fixtures:release-evidence-acquisition:check && pnpm fixtures:release-evidence-review-acquisition:check && pnpm verify:release-evidence-set -- --json && pnpm verify:release-evidence-review-archive-set -- --json && pnpm verify:dependency-security -- --json && pnpm verify:workflow-supply-chain -- --json && pnpm verify:action-pin-fixture && pnpm verify:action-pin-attestation-fixture && pnpm android:doctor",
+    "verify": "pnpm typecheck && pnpm test:coverage && pnpm build && pnpm docs:check && pnpm site:check && pnpm verify:public-economic-resilience-evidence && pnpm fixtures:compatibility:check && pnpm fixtures:ios-pass-replay:audit && pnpm fixtures:release-evidence-acquisition:check && pnpm fixtures:release-evidence-review-acquisition:check && pnpm verify:release-evidence-set -- --json && pnpm verify:release-evidence-review-archive-set -- --json && pnpm verify:dependency-security -- --json && pnpm verify:workflow-supply-chain -- --json && pnpm verify:action-pin-fixture && pnpm verify:action-pin-attestation-fixture && pnpm android:doctor",
     "android:doctor": "node scripts/android-verification.mjs doctor",
     "android:codegen": "node scripts/android-verification.mjs codegen",
     "android:build": "node scripts/android-verification.mjs build",

scripts/docs-semantic-core.mjs

@@ -5,6 +5,10 @@ import {
   statSync,
 } from 'node:fs';
 import path from 'node:path';
+import {
+  PUBLIC_ECONOMIC_RESILIENCE_ARCHIVE_ROOT,
+  inspectPublicEconomicResilienceArchive,
+} from './public-economic-resilience-evidence-core.mjs';
 
 export const STATUS_START = '<!-- package-status:start -->';
 export const STATUS_END = '<!-- package-status:end -->';
@@ -48,6 +52,7 @@ export const REQUIRED_DOCUMENTATION_FILES = [
   'docs/product-architecture.md',
   'docs/verification-architecture.md',
   'website/reference/evidence.md',
+  'website/reference/economic-resilience.md',
   'docs/maintainers/account-recovery.md',
   'docs/maintainers/repository-settings.md',
   'docs/maintainers/trusted-release.md',
@@ -629,6 +634,7 @@ export function inspectDocumentation(root) {
       'pnpm example:typecheck',
       'pnpm docs:check',
       'pnpm site:check',
+      'pnpm verify:public-economic-resilience-evidence',
       'pnpm fixtures:compatibility:check',
       'pnpm fixtures:repository-settings:check',
       'pnpm audit:repository-settings',
@@ -662,6 +668,37 @@ export function inspectDocumentation(root) {
     );
   }
 
+  const economicEvidencePath = path.join(
+    root,
+    'website/reference/economic-resilience.md'
+  );
+  if (existsSync(economicEvidencePath)) {
+    errors.push(
+      ...inspectEconomicResiliencePageContracts(
+        readFileSync(economicEvidencePath, 'utf8')
+      )
+    );
+    const publicArchive = inspectPublicEconomicResilienceArchive(
+      path.join(root, PUBLIC_ECONOMIC_RESILIENCE_ARCHIVE_ROOT)
+    );
+    if (publicArchive.status !== 'passed') {
+      errors.push(`public economic resilience archive: ${publicArchive.error}`);
+    } else {
+      const componentPath = path.join(
+        root,
+        'website/.vitepress/theme/EconomicResilienceArchive.vue'
+      );
+      errors.push(
+        ...inspectEconomicResilienceStateContracts({
+          archiveState: publicArchive.archiveState,
+          componentContents: existsSync(componentPath)
+            ? readFileSync(componentPath, 'utf8')
+            : '',
+        })
+      );
+    }
+  }
+
   inspectPublicLaunchContracts(
     root,
     packageJson.version,
@@ -898,6 +935,61 @@ export function inspectProductEvidenceContracts(contents) {
   return errors;
 }
 
+export function inspectEconomicResiliencePageContracts(contents) {
+  const errors = [];
+  inspectDecisionDocument({
+    label: 'economic resilience evidence',
+    contents,
+    headings: [
+      'What a capture must prove',
+      'Economic claim boundary',
+      'Append-only archive layout',
+      'Import and verify',
+    ],
+    snippets: [
+      '<EconomicResilienceArchive />',
+      'source-remains',
+      'matchedTransferBaseline: null',
+      'costSavingsClaim: null',
+      'workflow_dispatch',
+      'refs/heads/master',
+      'pnpm verify:public-economic-resilience-evidence',
+      'There is no mutable `latest`',
+    ],
+    errors,
+  });
+  return errors;
+}
+
+export function inspectEconomicResilienceStateContracts({
+  archiveState,
+  componentContents,
+}) {
+  const errors = [];
+  const required = archiveState === 'available'
+    ? [
+        'Archived source-tree capture',
+        'sourceToOutputByteDifference',
+        'uprightSimilarity',
+        'verticalFlipSimilarity',
+        'removedPackageOutputs',
+        'state.runUrl',
+        'Original artifact ZIP',
+      ]
+    : [
+        'Methodology preview · no archived capture',
+        'not a package release or a measured product result',
+      ];
+  for (const snippet of required) {
+    if (!componentContents.includes(snippet)) {
+      errors.push(
+        `economic resilience ${archiveState} state missing component contract: ${snippet}`
+      );
+    }
+  }
+  return errors;
+}
+
 function inspectDecisionDocument({
   label,
   contents,

scripts/economic-resilience-replay.mjs

@@ -0,0 +1,46 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCRIPT_DIRECTORY = path.dirname(fileURLToPath(import.meta.url));
+
+export function replayEconomicResilienceArtifact(artifactDir) {
+  const result = spawnSync(
+    process.execPath,
+    [
+      path.join(SCRIPT_DIRECTORY, 'verify-economic-resilience-evidence.mjs'),
+      '--artifact-dir',
+      path.resolve(artifactDir),
+    ],
+    {
+      cwd: path.resolve(SCRIPT_DIRECTORY, '..'),
+      encoding: 'utf8',
+      maxBuffer: 32 * 1024 * 1024,
+    }
+  );
+  if (result.error) throw result.error;
+  let report;
+  try {
+    report = JSON.parse(result.stdout);
+  } catch (error) {
+    throw new Error(
+      `economic resilience verifier returned invalid JSON: ${error.message}`
+    );
+  }
+  if (
+    result.status !== 0 ||
+    report?.status !== 'passed' ||
+    report?.replay?.status !== 'passed' ||
+    report?.replay?.measurementMatch !== true ||
+    report?.replay?.outcomesPassed !== true ||
+    report?.replay?.exactShapes !== true ||
+    report?.replay?.stableFieldsMatch !== true
+  ) {
+    throw new Error(
+      report?.error ||
+        result.stderr.trim() ||
+        'economic resilience independent visual replay failed'
+    );
+  }
+  return report;
+}