feat(release): bind hosted correction evidence

CHANGELOG.md

@@ -19,6 +19,8 @@ Planned first prerelease: `v0.1.0-beta.1`.
   committer identities, object integrity, owner approval, and secret scans.
 - Human-only publication handoff for the first hosted pull request, exact CI
   check discovery, direct bootstrap fast-forward, and protected-branch setup.
+- Fail-closed hosted-correction receipts that bind exact verifier source, local
+  history, remote refs, pull-request state, no-bypass rulesets, and checks.
 - Shared-checkout and detached linked-worktree lanes.
 - Exact staged-subset capture through private Git indexes.
 - All-or-nothing split plans with one final ref compare-and-swap.

README.md

@@ -348,8 +348,9 @@ authorizing its implementation. Non-authors can use the redacted
 [beta exercise](docs/BETA-EXERCISE.md) to produce independent evidence.
 Repository owners can use the human-gated
 [publication handoff](docs/PUBLICATION-HANDOFF.md) and
-[hosted setup runbook](docs/HOSTED-SETUP.md). These procedures do not authorize
-a push or release tag.
+[hosted setup runbook](docs/HOSTED-SETUP.md). Use the
+[correction receipt](docs/PUBLICATION-CORRECTION.md) after a hosted candidate
+changes. These procedures do not authorize a push or release tag.
 
 Project authority and succession are in [GOVERNANCE.md](GOVERNANCE.md).
 Current support and safe incident-reporting guidance are in

docs/KEP-0002-hosted-candidate-correction.md

@@ -1,6 +1,8 @@
 # KEP-0002: Hosted candidate correction receipt
 
-Status: Proposed
+Status: Accepted
+
+Implementation: Verified on 2026-08-17
 
 Decision owner: Repository owner
 
@@ -13,8 +15,9 @@ Target release: Before `v0.1.0-beta.1`
 Add a fail-closed receipt for a candidate that changes after the first public
 push. Keep the pre-first-push receipt immutable.
 
-The correction receipt must bind the old candidate, new candidate, local
-checks, remote refs, pull request, and hosted runs. It must bind the final tree.
+The correction receipt must bind the verifier, old candidate, new candidate,
+local checks, remote refs, pull request, and hosted runs. It must bind the final
+tree.
 
 This KEP does not authorize a tag or a pull-request merge.
 
@@ -29,10 +32,13 @@ candidate passed every required hosted check before `main` moved.
 The original receipt still proves the pre-first-push boundary. It does not bind
 the corrected final commit.
 
-## Decision request
+## Decision
+
+Use a second receipt type for post-first-push corrections. Require its
+`pre-main` phase before a corrected candidate moves to `main`.
 
-Approve a second receipt type for post-first-push corrections. Require that
-receipt before a corrected candidate moves to `main`.
+Use the `finalized` phase only to verify an observed bootstrap sequence. This
+phase does not claim that the receipt existed before `main` moved.
 
 ## Required sequence
 
@@ -54,10 +60,18 @@ If the first hosted candidate fails, use this sequence:
 Do not force-push a candidate branch. If a fast-forward is not possible, create
 a new branch.
 
+The implemented command also supports a finalized verification sequence:
+
+1. Keep the closed pull request and every hosted run.
+2. Check that the pull request closed without a merge.
+3. Check that remote `main` and the candidate ref equal the corrected commit.
+4. Run the complete local and hosted evidence command.
+5. Record that the receipt used the `finalized` phase.
+
 ## Receipt contract
 
 The command must write one new private JSON file. It must not overwrite a
-file or write inside the source checkout.
+file or write inside the candidate or verifier checkout.
 
 The receipt must bind:
 
@@ -68,42 +82,56 @@ The receipt must bind:
 - the old candidate commit and tree.
 - the new candidate commit and tree.
 - the complete merge-free correction range.
+- the verifier commit, tree, command digest, and schema digest.
 - the complete reviewed delta path list.
 - the local object and secret-scan results.
-- the public author and committer identity result.
+- the public author and committer email result.
+- a digest and count for every author and committer name and email.
 - the remote candidate and `main` refs.
 - the pull-request number, state, head, base, and merge result.
 - each required run ID, event, head commit, status, and conclusion.
 - each required check context and GitHub App integration ID.
 
-The receipt must exclude tokens, email addresses, local paths, private reports,
+The receipt must exclude tokens, identity values, local paths, private reports,
 and raw security logs.
 
 ## Command behavior
 
-Add a Go command under `scripts/`. The command must accept explicit repository,
-bootstrap, old candidate, candidate ref, and pull request values. It must also
-accept explicit run, path manifest, and output values.
+The Go command is `scripts/publication-correction`. The command accepts these
+explicit values:
+
+- candidate and verifier checkouts.
+- phase, bootstrap, old candidate, and new candidate.
+- candidate ref, pull request, ruleset, and hosted runs.
+- path manifest, first receipt, and output.
 
 The command must use bounded timeouts for GitHub, Git, and secret-scan
 commands. It must reject incomplete dependency injection in tests.
 
 The command must stop unless:
 
-- the checkout is clean.
+- the candidate checkout is clean and uses complete history.
+- the verifier checkout is clean and uses complete history.
+- the verifier command and schema are tracked at the recorded verifier commit.
 - the new candidate is the checked-out commit.
 - the old candidate is an ancestor of the new candidate.
 - the correction range is merge-free.
 - the complete bootstrap delta matches the path manifest.
 - object checks and secret scans pass.
-- all history identities match the public owner identity.
+- all history author and committer emails match the public owner email.
 - the target repository exists and is public.
 - the remote candidate ref equals the new candidate.
-- the pull request is open, unmerged, and points to the new candidate.
+- the pull request matches the selected phase and remains unmerged.
 - every required hosted run succeeded on the new candidate.
+- the ruleset has no bypass actor and protects deletion, force pushes, and
+  linear history.
+- the pull-request rule requires review, stale-review dismissal, last-push
+  approval, resolved threads, and rebase-only merges.
+- strict status checks apply to branch creation.
+- every ruleset check passed through its required GitHub App integration.
 
-The first version must create the receipt before `main` moves. A separate mode
-can check `main` after the fast-forward.
+The `pre-main` phase requires the open pull request and bootstrap `main`. The
+`finalized` phase requires the closed pull request and corrected `main`.
 
 ## Failure behavior
 
@@ -119,6 +147,8 @@ Test these cases:
 
 - exact one-commit correction success.
 - multiple linear correction commits.
+- clean verifier commit, tree, command digest, and schema digest.
+- dirty, wrong-module, or missing-artifact verifier checkout.
 - moved candidate ref.
 - changed path manifest.
 - merge commit in the correction range.
@@ -127,6 +157,9 @@ Test these cases:
 - pull request with a different head.
 - merged pull request.
 - private or different target repository.
+- missing ruleset protection or a ruleset bypass actor.
+- failed provider-bound check or changed GitHub App integration.
+- invalid or incomplete first receipt.
 - changed public identity.
 - secret-scan or object-check failure.
 - existing output file.
@@ -156,14 +189,20 @@ Rejected. The public history and hosted evidence already exist.
 
 ## Rollout gate
 
-Implement and test the command before the beta tag. Generate a private receipt
-for the correction from `ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d` to
+The command and test matrix passed before the beta tag. The finalized run bound
+the correction from `ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d` to
 `206fa8b6a1dde1d97081133e4d447c0881849922`.
 
-Record only the redacted result in public evidence.
+Verifier commit `6f36147f24f614cff0c7010533d864f8d9ad7628` produced the
+source-bound private receipt. Its digest is
+`sha256:77db44ba2bfa6f007186ace931f38444521d8a29cf48bd945e07a801eda36a9a`.
+Only the redacted result belongs in public evidence.
 
 ## Decision log
 
 | Date | Decision |
 | --- | --- |
 | 2026-08-17 | Propose a second immutable receipt for hosted candidate corrections. |
+| 2026-08-17 | The repository owner accepted KEP-0002. |
+| 2026-08-17 | Implement both phases and record the finalized correction receipt. |
+| 2026-08-17 | Supersede the provisional receipt with source-bound verifier and complete ruleset evidence. |

docs/OSS-PUBLIC-BETA.md

@@ -8,7 +8,7 @@ Target: `v0.1.0-beta.1`
 
 Owner: Repository owner
 
-Last review: 2026-08-16
+Last review: 2026-08-17
 
 Approval: `owner-session-2026-08-16`
 
@@ -36,8 +36,8 @@ final `main` checks.
 The active `main` ruleset and security settings passed the hosted setup audit.
 [PUBLICATION-EVIDENCE.md](PUBLICATION-EVIDENCE.md) contains the public record.
 
-No beta tag or GitHub release exists. The independent beta, conduct, correction
-receipt, security-notification, tag-approval, and tagged-install gates remain.
+No beta tag or GitHub release exists. The independent beta, conduct,
+security-notification, tag-approval, and tagged-install gates remain.
 
 This approval fixes the repository name, module path, and capture-only scope.
 It does not approve a release tag. The first-push handoff ran on 2026-08-17.
@@ -96,6 +96,8 @@ The owner-controlled repository work is complete. The checkout now contains:
   versions.
 - an exact minimum Go 1.25.12 gate that excludes reachable standard-library
   vulnerabilities found in Go 1.25.0.
+- a source-bound, fail-closed hosted-correction command, schema, negative test
+  matrix, and finalized private receipt for the first corrected candidate.
 
 Two clean six-target rehearsals produced equal directory trees. Every recorded
 archive checksum passed, and the native archive reported the target version.

docs/OSS-PUBLIC-BETA.requirements.yaml

@@ -444,13 +444,14 @@
       "id": "OSS-034",
       "gate": "public-beta",
       "title": "Bind hosted candidate corrections",
-      "status": "planned",
+      "status": "verified",
       "owner": "maintainer",
       "human_gate": false,
-      "acceptance": "A fail-closed Go command binds each post-first-push correction to the old and new candidates, complete path manifest, local checks, remote candidate ref, unmerged pull request, required hosted runs, and final tree in one immutable private receipt before main moves.",
+      "acceptance": "A fail-closed Go command binds each post-first-push correction to the old and new candidates, exact verifier source, complete path manifest, local checks, remote candidate and main refs, unmerged pull request, required hosted runs, provider-bound checks, complete no-bypass ruleset controls, and final tree in one immutable private receipt. The pre-main phase verifies the state before main moves. The finalized phase records an observed completed bootstrap sequence without claiming earlier receipt creation.",
       "evidence": [
-        {"kind": "kep", "value": "docs/KEP-0002-hosted-candidate-correction.md defines the receipt contract, sequence, failure behavior, and test plan.", "observed_on": "2026-08-17"},
-        {"kind": "gap", "value": "The first receipt binds ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d, while public main is 206fa8b6a1dde1d97081133e4d447c0881849922 after a hosted correction. No source command validates this correction flow yet.", "observed_on": "2026-08-17"}
+        {"kind": "artifact", "value": "scripts/publication-correction, docs/PUBLICATION-CORRECTION.md, docs/PUBLICATION-CORRECTION.schema.json, and accepted KEP-0002 implement the typed no-overwrite correction contract.", "observed_on": "2026-08-17"},
+        {"kind": "test", "value": "The correction matrix covers both success phases, exact clean verifier provenance, multiple linear commits, manifest drift, merge commits, object corruption, identity drift, remote and pull-request mismatch, run and check failure, each required ruleset control, secret scans, timeouts, unsafe output, no-overwrite behavior, redaction, deterministic encoding, and schema shape.", "observed_on": "2026-08-17"},
+        {"kind": "receipt", "value": "The validated finalized private receipt bound verifier commit 6f36147f24f614cff0c7010533d864f8d9ad7628, candidate correction ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d to 206fa8b6a1dde1d97081133e4d447c0881849922, tree c0dd6638adcdc231840ad06406dc9f0caa38e45d, 20 bootstrap paths, 5 correction paths, 4 hosted runs, 6 required checks, the complete no-bypass ruleset contract, and GitHub Actions integration 15368. Its SHA-256 digest is 77db44ba2bfa6f007186ace931f38444521d8a29cf48bd945e07a801eda36a9a.", "observed_on": "2026-08-17"}
       ]
     }
   ]

docs/OSS-READINESS.md

@@ -75,8 +75,8 @@ capture-only scope. It does not authorize a release tag.
 - Enabled dependency alerts, security updates, secret scanning, push
   protection, and private vulnerability reporting.
 - A clean public-module installation smoke test for the exact untagged commit.
-- A proposed hosted-correction receipt KEP for the finding that occurred after
-  the first push.
+- An accepted hosted-correction KEP, source-bound fail-closed command, schema,
+  test matrix, and finalized private receipt for the first hosted correction.
 - Fail-closed tests for unsupported state directories and record schemas.
 - Symlink-escape and dual-domain creation-race tests.
 - Concurrent first-use directory and no-clobber publication tests.
@@ -88,17 +88,15 @@ capture-only scope. It does not authorize a release tag.
 
 ## Required before the public beta tag
 
-1. Implement and run the correction receipt in
-   [KEP-0002](KEP-0002-hosted-candidate-correction.md).
-2. Verify the maintainer's personal security-alert notifications.
-3. Approve a Code of Conduct and configure confidential conduct reporting.
-4. Ask at least one independent user to follow
+1. Verify the maintainer's personal security-alert notifications.
+2. Approve a Code of Conduct and configure confidential conduct reporting.
+3. Ask at least one independent user to follow
    [BETA-EXERCISE.md](BETA-EXERCISE.md) for shared and worktree flows. Retain a
    redacted receipt that passes [BETA-EXERCISE.schema.json](BETA-EXERCISE.schema.json).
-5. Obtain explicit owner approval for `v0.1.0-beta.1`.
-6. Create the signed tag only after every tracked public-beta gate passes.
-7. Verify the hosted archives, checksums, and attestations.
-8. Install the final tag through the public Go module path.
+4. Obtain explicit owner approval for `v0.1.0-beta.1`.
+5. Create the signed tag only after every tracked public-beta gate passes.
+6. Verify the hosted archives, checksums, and attestations.
+7. Install the final tag through the public Go module path.
 
 ## Required before a stable release