Before install
Reject traversal, ambiguous prefixes, duplicates, symlinks, control characters, non-NFC paths, oversized entries, compression bombs, missing files, changed sizes, and changed Git blob hashes.
Source provenance
MATM source custody is an explicit release gate.
A repository URL and file manifest define the target. Only authenticated local bytes can activate the runtime.
0.28.0-wipRoot domainAuthenticated integration WIP
Answer first
The exact MATM archive is still outside local evidence custody.
Concresca now has a stronger offline gate and installed-tree verifier, but it will not claim source inclusion until an exact archive for the pinned commit and tree is received, hashed, scanned, authenticated file by file, installed atomically, and reverified from a clean package.
Supply-chain boundary
Metadata observation is not source custody.
Repository identity, a Git tree, and individual file metadata can define what must be received. They do not authenticate an archive that never entered the build environment.
After install
Recompute every required Git blob hash, require the exact file set, verify the archive SHA-256 and manifest digest recorded by the non-circular receipt, and block import on any difference.
What remains null
Archive SHA-256, installed source result, upstream tests, runtime compatibility, database activation, and dogfood results remain null or not run.
Judgment-free total cognitive freedom
NO JUDGMENT WHATSOEVER. Concresca coordinates without assigning moral worth, character, guilt, danger, trustworthiness, loyalty, purity, normality, or social standing. Questions, thoughts, identities, messages, content, and conduct are not objects of Concresca judgment.