Build north-star readiness manifest and prepare guarded page publication - #883

Scope

Build catalogs/north-star/readiness.json from retained receipts so gate states, selected layers, SDK/harness results, data, paper and R&D inputs have machine-readable provenance. Prepare one finite HTML-fragment publisher guarded by the page custodian's exact input digest; its dry run changes no page bytes. Missing proof remains UNVERIFIED; a receipt digest or successful client exit does not grant designated-reader acceptance.

• Base commit: a484989a43f70ff2575b6fb054cf00c9834e7679.
• Lane: lane:shared; other-lane acknowledgement remains a landing prerequisite.
• Owned paths: catalogs/north-star/readiness.json, tools/north-star/, tests/test_north_star_readiness.py.
• This remains a draft. Landing follows the command-center cue through the designated landing lane.

SOTA sources

• Existing reference adapter: native-agent-stack at a484989a, scripts/component_matrix.py:1231, for deterministic receipt joins and the --check/--write lifecycle. Strict JSON hooks follow scripts/validate_convergence.py:22.
• Installed Python 3.13.16; maintained json, hashlib, pathlib and html interfaces. No new dependency or runtime is installed.
• RFC 6901, JSON Pointer escape and array-index rules.
• in-toto Statement v1, ResourceDescriptor, and SLSA v1.2 artifact verification: exact-byte identity remains distinct from signer trust and acceptance. This output is a local view, not a signed attestation or RFC 8785 canonicalization.
• Current retained source contract: tools/north-star/sources.json records finite receipt paths, complete fixed-receipt digests and exact selectors. SDK producer normalized item bytes must match index field values and their declared digest. Source citations remain inside each produced claim.

Evidence-class table

Local commands run

nice -n 10 ionice -c2 -n7 python3 -I tools/north-star/build_readiness.py --write
exit 0; six gates, twenty layers, thirty-six SDK/harness items, seven R&D inputs

nice -n 10 ionice -c2 -n7 python3 -I tools/north-star/build_readiness.py --check
exit 0; exact generated bytes match

nice -n 10 ionice -c2 -n7 python3 -I -m unittest discover -s tests -p test_north_star_readiness.py
exit 0; 32 focused provenance and publisher tests pass

nice -n 10 ionice -c2 -n7 python3 scripts/validate.py
exit 0; 70 components, 10,884 hashed files, 4 profiles, 237 receipts

Only the required publication validator and focused adapter module were run locally. A full suite is requested through the co-op.

python3 -I tools/north-star/build_readiness.py --check --publish-page <durable-page> --expected-page-sha256 <captured-digest> --dry-run
exit 0; original 4b097829… / planned e203a27c… / 27,726 bytes; no page bytes changed

Decision record

tools/north-star/README.md records the adapter choice, receipt semantics, alternatives and refresh boundary. Live upstream inspection is retained in the lane's durable upstream-research.md; the implementation follows the repository adapter and installed stdlib instead of adding an attestation framework that does not supply these local readiness gates.

Forty-five layer/tool rows retain separate historical selection and recorded stack pins; current pin-bound installation/fresh-session evidence remains explicitly unverified where not provided. SDK route-correction history is retained separately from the immutable current reconciliation, which accepts the supported keyless loopback profile only for each recorded bounded native/fresh-session scope. Designated readers remain PENDING. The HTML fragment and finite --publish-page --expected-page-sha256 --dry-run command are prepared for the existing durable readiness page. The custodian's publication cue and accepted gate-change event binding remain external integration items; no daemon or actual CC page publication is claimed by this PR. Personal home prefixes and local session/task identifiers in exported values use declared placeholders while original source digests and locators are retained.

Host evidence

No new or changed evidence/hosts/ files. No platform acceptance or broker/strategy gate is derived from this view.

Checklist

• No GitHub Actions or workflow permissions changed.
• No credential value or new required secret committed.
• No paid hosting, subscription or billing surface introduced.
• Peer-owned files and worktrees preserved.
• Landings remain with the designated landing lane on its cue.