Build and verify the publication

The analytics dependency is a reviewed local bundle. To reproduce it, use Node.js 24.11.1 and run npm ci --ignore-scripts and npm run build in tools/analytics-vendor. Compare tools/assets/aws-rum-vendor.d56ddb85e6710adc.js with the SHA-256 in third-party/manifest.json. The exact lock and notices accompany the public source; normal builds use reviewed bytes without downloading code.

Settings are maintained in publication/analytics.json. Collection stays inactive when disabled, on other hostnames, or when browser privacy controls prohibit it. Activation requires approved AWS resources, real monitor and identity-pool identifiers, and exact regenerated publication hashes. The existing Rights area carries the privacy disclosure. Private operations and reporting are excluded from publication archives.

The repository contains the maintained public Markdown, conceptual figures, publication styling, and build tools. It builds sixteen individual PDFs, a collected volume, and a searchable static website. No private source vault, credentials, research-system implementation, or external account is needed for a local build.

These instructions support inspection and verification under the rights notice. They do not grant an open-source license to the authored research or tooling. Distributed third-party components retain the licenses described in Third-party notices.

Environment

Use CPython 3.12.14 in an isolated environment for the recorded release build. Install the exact versions and distribution hashes in requirements.lock. The PDF renderer uses DejaVu fonts supplied by the pinned Matplotlib package. The website uses an Inter and system-font stack with a locally served DejaVu fallback. The browser does not need a remote font service.

The website starts in dark mode. Its sun and moon control uses the theme's built-in palette selection and browser storage to preserve the reader's choice across pages and visits. Conceptual figures inherit the selected website palette and reflow to the available reading width. Technical timelines retain legible print colors on wide screens and become paired, numbered owner/witness steps on phones. The assurance diagram becomes ruled terms and descriptions; both retain a complete text alternative. These views are derived from the same maintained SVG text used in the PDFs.

The menu button opens a sliding collection drawer on every screen size. Close it with the close button, the shaded background, or Escape. Keyboard focus stays within the open drawer and returns to the menu button when dismissed. The separate On this page control opens the current page's contents on demand at every screen size. Escape, the close button, or the shaded background dismisses it. Neither panel reserves a permanent column in the reading layout. Overview returns to the collection's introduction. The header's Open in git link opens the repository. Scrollbar tracks are hidden throughout the website; wheel, touch, and keyboard scrolling remain available, including horizontal scrolling in tables and code examples. Reduced-motion preferences remove the drawer animation.

Headings use a restrained size scale and one semibold weight. Introductory paragraphs share the same body size and regular weight; section dividers and spacing separate the reading blocks. A fixed reading trail at the right edge links to the overview, the page's collection group, the current page, and the current section's ancestors. It updates with scrolling without adding browser-history entries. Selecting a collection group opens that group in the existing collection drawer. On narrower screens, a vertical tab shows the current section and opens the trail on demand; Escape or a click outside closes it. The trail stays outside the reading column and is omitted from print.

The overview presents its responsibility map as aligned label-and-question rows, its three contributions as numbered columns with shared heading and paragraph baselines, and the collection as a subject index with numbered paper links. Fine dividers separate the subjects without enclosing them in cards. Reading routes use aligned terms and descriptions. These layouts respond to the width of the reading column: narrow screens stack the text and paper links, and all content remains in normal reading order. The overview enhancement derives every paragraph, subject and link from README.md; the print edition retains that maintained text.

On Linux, the Cairo build dependency may require the operating system's Cairo development package and pkg-config. The publication workflow installs these before the Python requirements. The local commands below assume that the environment's Python is active.

python -m venv .venv

Activate the environment with .venv\Scripts\Activate.ps1 in PowerShell or source .venv/bin/activate in a POSIX shell, then install the requirements:

python -m pip install --require-hashes --requirement requirements.lock

Installation can require network access to the configured package index. Pip verifies the selected distributions against the recorded SHA-256 values. The smaller requirements-pages.lock permits the deployment job to install only its two artifact-inspection dependencies with the same hash checks. The build itself reads the public repository and installed packages. It does not fetch or execute the private research corpus.

Build a complete edition

Run from the repository root:

python tools/figures.py
python tools/build.py --pdf --site
python tools/verify.py --artifacts
python tools/qa.py --artifacts
python tools/disclosure.py --history --output .build/source-disclosure.json
python examples/continuity/verify.py --output .build/reference-evidence.json

The full build requires every positively allowlisted publication file. Unknown files are not copied into generated artifacts. MkDocs runs in strict mode. The verifier checks source metadata, internal links and anchors, disclosure markers, website links and landmarks, search and download availability, personal author attribution, PDF metadata and bookmarks, complete paragraph/table coverage, page bounds, and artifact hashes. PDF generation and verification inspect every cross-reference object, including orphan objects, and reject local-file launch actions, remote file actions, file specifications and other active content. Internal PDF destinations are retained; cross-document references use approved HTTPS website routes whose files and section anchors are checked against the generated site. Its result is written to .build/verification.json. The separate QA tool checks exact claim coverage and evidence types, actual reference output, source commitments, workflow approval boundaries, metadata, media, generated disclosure and negative security controls. Its result is .build/qa.json. Semantic IP review and author approval are separate from automated scanning.

The commands produce:

Location	Contents
.build/pdf/	Sixteen paper PDFs, the collected volume, editions.json, and their source/ companion
.build/site/	Complete static website, including the same PDF downloads
.build/docs/	Generated website inputs; edit the maintained Markdown instead
publication/manifest.json	Content hashes for this edition
.build/verification.json	Results of the publication checks
.build/qa.json	Claim, reference, workflow and generated integrity checks
.build/site/llms.txt and llms-full.txt	Discovery routes and the complete maintained public prose

The tool checks the scope of its generated directory before removing obsolete generated inputs. It does not clean the repository or modify a separate source collection. Generated output is excluded from ordinary source control; release assets and the website carry the built copies.

python tools/build.py --draft --pdf --site supports incomplete authoring previews. A draft build trims unavailable navigation entries and does not establish release completeness. Release preparation uses the full commands above.

Preview and inspect

The homepage browser title, share title, and description are maintained in mkdocs.yml and rendered by tools/theme/main.html. Open Graph and Twitter previews use the original 1200 × 630 research identity graphic in tools/assets/publication-cover.png. Other pages retain their own titles and canonical URLs. The image is included in the positively selected public source and served locally by the publication website.

python -m http.server 8174 --bind 127.0.0.1 --directory .build/site

Open the local preview in a browser. Check desktop and narrow layouts, keyboard navigation, search results, paper metadata, diagrams, source links, and PDF downloads. Inspect representative rendered pages from every PDF, including covers, contents, figures, tables, long headings, and the final page. Automated text and boundary checks complement visual inspection; they do not replace it.

For a reviewer receiving an already built package, no build environment is needed to read the PDFs or source. The complete review ZIP includes a READ_ME_FIRST.md with reading routes and instructions for serving the included website/ folder using Python's standard local server. See Downloads.

The PDFs contain selectable Unicode text, embedded fonts, bookmarks, and links. The collected volume opens with a compact document-level reading map, followed immediately by the overview and papers. Its complete detailed contents follow the reading material; section bookmarks remain available throughout. Closing glossary distinctions stay together as a short discussion. The PDFs are not represented as independently certified PDF/UA documents. Readers who prefer reflowable text can use the website or maintained Markdown.

Links to material included in the same PDF stay within that document. Other collection links open the exact maintained text in the accompanying source/ directory. The builder includes that directory beside the PDFs and under website downloads; it identifies the same content snapshot without requiring a remote tag or account. Keep it with the PDFs when extracting a complete review package. A separately downloaded paper retains its text and internal navigation; its related-source links require the accompanying directory. Release downloads retain their edition-specific URLs.

Identity and reproducibility

The content manifest hashes every positively selected source file except the manifest itself. It orders entries by their repository-relative POSIX names on every operating system. It includes text, figures, claims, reference source, fixtures, rights, third-party notices, dependency pins and tooling. PDF covers identify that content digest. editions.json records each generated PDF's hash and page count. These records distinguish source content from the bytes of a particular render.

The edition policy fixes SOURCE_DATE_EPOCH=1791590400 (10 October 2026 UTC); the build sets it and rejects a different supplied value. The renderer suppresses variable PDF timestamps. Archives have sorted members, fixed timestamps and ordinary file modes. Exact package versions reduce avoidable differences, but cross-platform font, XML, compression or rendering differences can still affect bytes. Reproducing content identity and passing publication checks are separate observations from reproducing every output byte. Report the environment and both results when comparing builds.

The website search index, its theme script, the publication stylesheet, and the reading controls use content-derived filenames. A rebuilt website therefore loads its matching search text, styling, and controls even when a reader's browser retains assets from a previous visit. The build verifies the pinned theme integration and records the search index and script fingerprints in search/identity.json; artifact checks verify every page uses the matching script. The palette preference remains owned by the theme's existing storage.

Publication checks do not validate the proposed research systems, prove the arguments, establish IP ownership, or demonstrate a production deployment. See the evidence guide for those distinctions.

Repository workflows and releases

The verification workflow builds and checks main-branch changes and pull requests with a read-only repository token. It fetches the publication's complete Git history so the disclosure check inspects every reachable Git object, including historical file bytes, trees, commits and annotated tags. A history audit refuses a shallow checkout and requires the scanned commit count to match Git's reachable count. Unknown historical paths are reported and their bytes are still inspected. The scanner's own source receives the same credential checks; only its exact historical regex definition is normalized to distinguish literal pattern syntax from a real access identifier. QA exercises an actual shallow checkout and unsafe orphan PDF objects as negative controls. Verification reads only this publication checkout and installed public dependencies. Third-party actions are pinned to commit identifiers; no private repository or production evidence is fetched.

Public distribution uses an isolated manual static deployment. The Enterprise repository remains private and authoritative. Public source archives contain only the latest positively allowlisted files, with no Git database, historical commit metadata or private verification receipts. A public source snapshot is identified by its exact source-content digest and file inventory; it is not a public Git repository.

Prepare the complete assets locally after both verification commands pass:

python tools/release.py --prepare .build/release
python tools/release.py --verify-review .build/release/governed-autonomy-2026.10.6-review.zip --manifest .build/release/RELEASE_MANIFEST.json
python tools/release.py --prepare-static .build/release --output .build/static-deployment

The release manifest identifies the complete source, website and PDF payloads and the source/website archives. Detached artifact hashes identify all final release containers without circular self-hashing. The separate static deployment inventory identifies the website and the exact release downloads. The deployment ZIP includes those approved files without nesting itself into the website ZIP or review ZIP. Approval binds the source digest, release manifest, every release asset, static payload inventory, deployment ZIP and public destination.

Before any public upload or deployment, verify the approved local files:

python tools/release.py --verify-static .build/static-deployment --approved-source-sha256 SOURCE_SHA256 --manifest-sha256 MANIFEST_SHA256 --deployment-sha256 DEPLOYMENT_ZIP_SHA256

Replace the command arguments with the exact recorded approval hashes. This check must pass before uploading the deployment ZIP to the isolated hosting app. Use only a manually created publication app and branch, with no Git connection, backend environment, application role, automatic build, migration dependency or production integration. The hosting app and deployment operation are maintained privately; account identifiers and upload credentials are never put into public files. No GitHub Pages deployment is used.

After explicit approval, upload and deploy the exact verified ZIP. Verify the real unauthenticated website, HTTPS, search, navigation, all seventeen PDFs, complete source snapshot, full text and every release download against the approved hashes. A previous approved static ZIP can be redeployed with its own approval receipt. Preserve all source history and release evidence privately. Corrections require a new reviewed artifact set; never silently replace an approved artifact with different bytes.

Corrections update the maintained content and changelog, then receive a new reviewed artifact set. Do not silently replace an approved publication with different content under an unchanged artifact identity.