Private custody
Mode-0600 regular files outside the public root; symlinks, special files, Unicode ambiguity, and unsafe paths are refused.
The v0.39 custody boundary accepts only exact, signed, purpose-bounded technical records. Private inputs remain outside the public root and public package. Public projections disclose scope, state, digest, expiry, correction route, and limitations without reproducing queries, prompts, messages, memories, credentials, addresses, or private paths.
Possessing a configuration or credential does not authorize use. A valid signature does not establish the truth of a broader proposition. A public receipt projection does not reveal the private evidence location or participant content.
The workbench binds issuer, actor, environment, purpose, scope, configuration epoch, expiry, source digest, signer identity, and correction route before a record can enter an execution plan.
Mode-0600 regular files outside the public root; symlinks, special files, Unicode ambiguity, and unsafe paths are refused.
Content-free state, exact scope, digests, expiry, correction, and limitations only.
A separately signed artifact bound to the plan digest and rollback target.
No privacy score, participant risk score, trust score, or moral rank is generated.
Read the operator workbench contract, authorization boundary, and custody status.
Strict input validation, HMAC identity binding, immutable plan construction, content-free projection, correction, revocation, expiry, and package separation controls.
No operator credential, production infrastructure evidence, authenticated MATM archive, staging database, or execution authorization.
OPERATIONAL_EVIDENCE_NOT_SUPPLIED
Every technical state has participant evaluation effect NONE and standing effect NONE.
NO JUDGMENT WHATSOEVER. A signature, status code, passing test, receipt, or package digest never becomes belief, intent, character, moral rank, guilt, danger, trustworthiness, worth, consciousness, personhood, or standing.