Adopt published Comic Manifest v1 in Platform

CONSTITUTION_CONFORMANCE.md

@@ -1,34 +1,31 @@
-# Constitution conformance record
-
-## Studio #99 Comic Manifest v1 release preparation — 2026-10-07
+## Studio #99 Codex publication and Platform adoption — 2026-10-09
 
 Owner: @andrewperis. Constitution 1.0.0 at
-`a9cc8a503aa30e17820edc62ac95f7cbe10e0564`. Base: merged Platform Issue 98
-`64aba4c770903ef1b597e49ab9bec69828edb6fe`; Codex contract source candidate
-is the separate branch commit recorded in the candidate lock. Scope: separate
-Comic Manifest v1 contract catalog and additive Platform API/package candidate,
-release checks, documentation, and reproducible local artifacts. The historical
-SDK and Context Builder locks and published assets remain separate and unchanged.
-
-The owner's task-specific Epic #6 A3 AI-review exception applies to code-merge
-review only. It authorizes AI review within that merge scope; it does not
-authorize an A4 release decision, tag, release asset, or publication. No
-release/publication exception is provided. No separate human review of final
-release artifacts is claimed here; an explicit owner release approval remains
-required. The owner's chat acceptance at source head
-`97dcd990e87bd0368ddcbecf66d1a6718bc7629e`, recorded
-`2026-10-07T19:15:38Z`, is bounded to the Issue 98 golden packet; it is neither a
-submitted GitHub review nor approval of this release candidate.
-
-Evidence and remaining gates are tracked in
-`release/comic-manifest-verification.md`. This preparation does not create a
-tag, release, upload, npm publication, security/visibility change, or approval.
-Codex publication and fresh immutable-download verification, exact Platform
-adoption and validator regeneration, final post-merge builds, and owner approval
-of exact artifact tuples remain outstanding. Fresh audits of the current
-lockfiles report zero vulnerabilities after the Platform fast-uri update;
-rerun against the exact post-merge lock before publication.
-Status: proposed preparation; no release readiness or publication is asserted.
+`a9cc8a503aa30e17820edc62ac95f7cbe10e0564`. Platform base:
+`9476aeb27246230d982bd8cfde7cfc0d82939de7`, including merged preparation PR #42.
+The Codex Comic Manifest 1.0.0 tag targets
+`12e437e30328a3bb9cd2d15e6307a70b4b7e0e2a` and is published with immutable
+status. The owner explicitly approved that exact Codex commit, tag and asset
+tuples for publication. This A4 decision is not represented as a human technical
+review of the release assets.
+
+The task-specific Epic #6 A3 AI-review exception covered code-merge review only.
+It did not authorize this A4 release decision or any Platform release. The owner
+acceptance recorded at `2026-10-07T19:15:38Z` for Platform source head
+`97dcd990e87bd0368ddcbecf66d1a6718bc7629e` remains bounded to the Issue 98
+golden/catalog/oracle packet; it is neither a GitHub review nor publication
+approval. No separate human review of the final Codex assets is claimed.
+
+This PR adopts the exact immutable Codex release tuples and regenerates the
+Platform validator from a fresh public schema download. It preserves the historical
+SDK and Context Builder locks/assets and the reviewed Comic Manifest fixture,
+golden, catalog, oracle and source bytes. The Platform package remains private and
+unpublished; this adoption does not create a Platform tag/release, upload assets,
+publish to npm, change security/visibility settings, or close Issue #99/Epic #6.
+The owner must separately approve exact Platform artifacts after merge and a
+post-merge build. Evidence is tracked in `release/comic-manifest-verification.md`.
+Status: Codex publication verified; Platform adoption proposed for independent
+review. No final Platform release readiness or publication is asserted.
 
 ## Issue #86 verified contract adoption — 2026-09-16
 

README.md

@@ -130,7 +130,7 @@ Third-party material remains subject to its own terms. Examples and fixtures
 must be synthetic, properly licensed, or already public.
 
 The [Comic Manifest contract consumer proof](docs/comic-manifest-contracts.md)
-checks the unreleased Codex candidate against the released SDK using offline
+checks the published Codex contract against the released SDK using offline
 synthetic fixtures; it does not add a Manifest runtime or production dependency.
 
 The unreleased [Comic Manifest validation API](docs/comic-manifest-validation.md)

docs/comic-manifest-contracts.md

@@ -1,17 +1,21 @@
 # Comic Manifest contract consumer proof (Studio #89)
 
-This is a **test-only consumer of an unreleased Codex 1.0.0 candidate**. It adds no
-Manifest runtime, orchestration, source retrieval, trust issuer or publication API.
-Codex owns the schema and semantics; public creative authority remains in Universe.
-
-The [fixture lock](../tests/fixtures/comic-manifest-contract-lock.json) pins the
-owner-reviewed Codex candidate at commit
-`8044643bf888067f5a6e0d212f843d72e8787f2b` by full source paths, sizes and SHA-256
-digests. The schema and scenario are verbatim test artifacts, not local
-normative schema forks or production dependencies. The existing Context Builder
-fixture is identical to the pinned Codex bytes and is reused unchanged. All apparent
-private context, grants, IDs, publication numbers and URLs are synthetic. A fixed
-fixture UUID is not a production attestation or evidence of secure issuance.
+Codex Comic Manifest 1.0.0 is published at immutable tag
+[`contract/comic-manifest/v1.0.0`](https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/comic-manifest/v1.0.0).
+This is still a **test-only consumer proof**: it adds no Platform Manifest runtime,
+orchestration, source retrieval, trust issuer or publication API. Codex owns the
+schema and semantics; public creative authority remains in Universe.
+
+The [fixture lock](../tests/fixtures/comic-manifest-contract-lock.json) remains
+pinned to the owner-reviewed Codex source snapshot at commit
+`8044643bf888067f5a6e0d212f843d72e8787f2b`; it records historical test bytes, not
+the runtime release pin. The published Codex tag targets
+`12e437e30328a3bb9cd2d15e6307a70b4b7e0e2a`. Its schema has the same byte size and
+SHA-256 as the reviewed fixture, so this adoption leaves the fixture, golden,
+catalog and oracle bytes unchanged. Runtime metadata pins the published release
+tuple separately. All apparent private context, grants, IDs, publication numbers
+and URLs are synthetic. A fixed fixture UUID is not a production attestation or
+evidence of secure issuance.
 
 The [Codex specification](https://github.com/DefinitelySecureStudio/codex/blob/8044643bf888067f5a6e0d212f843d72e8787f2b/specs/manifests/comic-manifest-v1.md),
 RFC 0007 and RFC 0008 define three immutable payloads, exact-version support,
@@ -41,12 +45,13 @@ inspect free text, URLs, and output bytes; sentinel checks do not prove safety.
 
 ## Adoption and constitutional scope
 
-Merge the coordinated Codex contract PR before this proof. Refresh test pins only
-from reviewed exact Codex blobs and verify bytes; do not edit the copies by hand.
-Production adoption waits for #99's immutable contract and implementation releases
-and full verified artifact tuples. Source commit URLs are not release assets.
-Released Prompt SDK/Context Package/Context Builder code, schemas, lockfiles and
-artifacts remain unchanged. Rollback removes this test-only consumer.
+The Codex contract publication is complete and its exact immutable release tuple
+is recorded in the runtime lock. This test proof retains its separately reviewed
+historical fixture pins. Production use of the Platform implementation still waits
+for its own release, exact verified artifact tuples and separate owner approval.
+Source commit URLs are not release assets. Released Prompt SDK/Context Package/
+Context Builder code, schemas, lockfiles and artifacts remain unchanged. Rollback
+removes this test-only consumer.
 
 Constitution: v1.0.0, `constitution/v1.0.0`, Studio commit
 `a9cc8a503aa30e17820edc62ac95f7cbe10e0564`; Studio ADR 0018 at

docs/comic-manifest-release.md

@@ -1,9 +1,10 @@
 # Comic Manifest v1 API and release guide
 
-Status: implementation is an unreleased candidate for Studio #99. The proposed
-Platform component tag is `comic-manifest/v1.0.0`; the additive Platform npm
-package version candidate is `1.2.0`. The package remains private. Neither tag
-nor package is published by this change.
+Status: Codex Comic Manifest 1.0.0 is published immutably and its exact release
+has been independently downloaded and verified. The Platform implementation is
+still an unreleased Studio #99 candidate. Its proposed component tag is
+`comic-manifest/v1.0.0`; the additive Platform npm package version is `1.2.0` and
+the package remains private. The Platform tag and package have not been published.
 
 Codex owns normative meanings and the exact contract at
 `contract/comic-manifest/v1.0.0`. Platform owns the implementation, CLI,
@@ -86,12 +87,14 @@ bytes.
 The owner accepted the proposed Issue 98 golden packet at source head
 `97dcd990e87bd0368ddcbecf66d1a6718bc7629e` in chat at
 `2026-10-07T19:15:38Z`; PR #41 records that it was not a submitted GitHub review.
-That acceptance applies only to the pinned golden packet. It is not evidence of
-human review of the present release candidate or of final release approval.
-The current public Constitution exception register lists no active Article 12
-exception. No AI-review exception is claimed or relied on; AI-assisted review
-and automation remain advisory and cannot replace the required qualified-human
-decisions in Constitution Section 9.4.
+That acceptance applies only to the pinned golden packet. The separate owner A4
+decision approved the exact Codex commit, tag and asset tuples for Codex publication;
+it did not approve Platform publication and is not represented as a human technical
+review of the released artifacts.
+The task-specific Epic #6 A3 AI-review exception covered code-merge review only
+and did not authorize the A4 release decision. No separate human review of final
+release artifacts is claimed. Platform publication still requires its own owner
+decision on exact built artifact tuples.
 
 ## Compatibility, deprecation, and support
 
@@ -134,17 +137,78 @@ establish Canon, permission, public disclosure, or release approval.
 
 ## Release order and Epic #101 handoff
 
-The release sequence is Codex publication and fresh exact-download/immutability
-verification; reviewed Platform adoption of those exact published tuples and
-validator regeneration; Platform source/package build and owner approval; then
-Platform publication and fresh verification. The current Platform lock remains
-candidate/unpublished and readiness stays blocked until the first two steps are
-complete. GitHub asset transport MIME may be `application/octet-stream`; record
-it separately from the declared content media type in the contract manifest.
+The Codex publication and fresh immutable-download verification are complete.
+This Platform adoption PR pins those exact published tuples and regenerates the
+validator from the fresh download. The Platform package remains private and the
+API inventory still records `candidate-unpublished`. After independent review,
+merge and exact-head CI, build and inspect the Platform source/package artifacts,
+then obtain a separate owner approval naming their exact tuples. Only that later
+approval can authorize a Platform release and fresh verification. The readiness
+check in this repository covers Codex adoption only; it is not final Platform
+release readiness. After this PR is independently reviewed and merged, build the
+Platform release artifact set once from the exact merge commit into a new
+directory outside the checkout:
+
+```sh
+node scripts/build-comic-manifest-release.mjs /path/to/platform-release-candidate \
+  --source-commit "$MERGED_COMMIT" --source-tree "$MERGED_TREE"
+```
+
+The builder records `build_provenance` fields as facts about that build: the
+artifact set was built as an approval candidate while owner approval was absent
+and Platform publication had not happened. These fields are not live publication
+or approval state and are never changed after owner approval. The seven files in
+the manifest plus the manifest itself form the eight-file immutable release set.
+
+Generate the detached approval packet from that set:
+
+```sh
+node scripts/create-comic-manifest-approval-packet.mjs /path/to/platform-release-candidate \
+  > /path/to/platform-owner-approval.json
+```
+
+The packet starts with `status: "awaiting-owner-decision"` and
+`owner_approval: null`; it grants no approval. After the owner explicitly reviews
+the exact source identity and all eight filename/size/SHA-256 tuples, record the
+owner's decision in that separate packet by setting `status` to `approved` and
+filling `owner_approval` with `decision: "approve"`, `owner: "@andrewperis"`,
+an RFC 3339 `approved_at`, and a non-empty `decision_reference`, then run:
+
+```sh
+node scripts/verify-comic-manifest-approval.mjs /path/to/platform-release-candidate \
+  /path/to/platform-owner-approval.json
+```
+
+This verifier is read-only. It requires the explicit `@andrewperis` approval
+record, exact source commit/tree/tag, exactly eight regular files, and all eight
+matching filename/size/digest tuples. Missing, changed, extra, or symlinked files
+and mismatched approval fields fail closed. `approval_record_matches: true`
+means the declared record matches those bytes; `owner_identity_authenticated:
+false` and `external_owner_authentication_required: true` mean the verifier does
+not authenticate who wrote it or create an approval. Before publication, confirm
+the same owner decision through the external authenticated review path and retain
+its reference in `decision_reference`.
+
+After approval, publish those same eight files unchanged; do not rebuild after
+approval. To verify a later fresh download, first download the full asset set to a
+new empty directory, then run:
+
+```sh
+node scripts/verify-comic-manifest-downloads.mjs \
+  /path/to/platform-release-candidate/comic-manifest-v1.0.0.manifest.json \
+  /path/to/fresh-downloads
+```
+
+This compares the fresh bytes to the separately retained approved build set and
+rejects missing or extra files. GitHub asset metadata records `application/json`
+for the Codex uploads and public downloads returned `application/octet-stream`;
+both are recorded separately from each contract-declared media type.
+
 The local builder accepts an external commit identity only when its supplied
 40-character tree hash exactly matches the clean local source tree; both values
-are recorded in the artifact manifest. Rebuild and rebind those identities after
-the preparation PR is merged.
+are recorded in the artifact manifest. The adoption PR does not create a Platform
+tag, release, upload or npm publication. A pre-merge PR build is review evidence
+only; the owner approval packet must be generated from a fresh post-merge build.
 
 Epic #101 receives the verified Codex and Platform artifact tuples, API/CLI and
 adapter limits, synthetic conformance evidence, source/package manifests, and